From 6518a19cd6d739a827c063f6957a0944cf0224b1 Mon Sep 17 00:00:00 2001
From: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Date: Thu, 8 Oct 2026 17:18:20 -0700
Subject: [PATCH] Save sysroot and Coverage caches only on main

PR runs saved these caches under their own ref, where no other run can
restore them, using shared cache space. Saving the sysroot in a job step
also runs before rust-cache's post-job cleanup, which emptied the
sysroot before actions/cache saved it on main.

Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
---
 .github/workflows/Coverage.yml         |  3 +++
 .github/workflows/dep_build_guests.yml | 17 ++++++++++++--
 .github/workflows/dep_code_checks.yml  | 32 ++++++++++++++++++++++----
 3 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/Coverage.yml b/.github/workflows/Coverage.yml
index 9ac052355..ee36b2a80 100644
--- a/.github/workflows/Coverage.yml
+++ b/.github/workflows/Coverage.yml
@@ -53,6 +53,9 @@ jobs:
         with:
           shared-key: "${{ runner.os }}-debug"
           cache-on-failure: "true"
+          # Only save on main as caches are not shared across branches.
+          # https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#restrictions-for-accessing-a-cache
+          save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Set up sccache
         uses: ./.github/actions/setup-sccache
diff --git a/.github/workflows/dep_build_guests.yml b/.github/workflows/dep_build_guests.yml
index 063969b00..2c0f23a76 100644
--- a/.github/workflows/dep_build_guests.yml
+++ b/.github/workflows/dep_build_guests.yml
@@ -88,8 +88,9 @@ jobs:
       # cargo-hyperlight builds a custom sysroot for the Hyperlight guest target.
       # rust-cache cleans "anything not a dependency" from target dirs, removing the sysroot.
       # We cache sysroot separately to avoid rebuilding it (~10s) on every run.
-      - name: Sysroot cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+      - name: Restore sysroot cache
+        id: sysroot-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: |
             src/tests/rust_guests/target/sysroot
@@ -145,3 +146,15 @@ jobs:
           path: src/tests/c_guests/bin/${{ inputs.config }}/
           retention-days: 1
           if-no-files-found: error
+
+      # A job step, not a post-job step, so the save runs before rust-cache's
+      # post-job cleanup deletes the sysroot. Only main saves, as caches are not
+      # shared across branches.
+      - name: Save sysroot cache
+        if: ${{ github.ref == 'refs/heads/main' && steps.sysroot-cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          path: |
+            src/tests/rust_guests/target/sysroot
+            src/tests/rust_guests/target-non-pie/sysroot
+          key: ${{ steps.sysroot-cache.outputs.cache-primary-key }}
diff --git a/.github/workflows/dep_code_checks.yml b/.github/workflows/dep_code_checks.yml
index f75a52610..a6962fabd 100644
--- a/.github/workflows/dep_code_checks.yml
+++ b/.github/workflows/dep_code_checks.yml
@@ -48,8 +48,9 @@ jobs:
       # cargo-hyperlight builds a custom sysroot for x86_64-hyperlight-none target.
       # rust-cache cleans "anything not a dependency" from target dirs, removing the sysroot.
       # We cache sysroot separately to avoid rebuilding it (~10s) on every run.
-      - name: Sysroot cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+      - name: Restore sysroot cache
+        id: sysroot-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: |
             src/tests/rust_guests/target/sysroot
@@ -101,6 +102,17 @@ jobs:
       - name: Run loom concurrency tests
         run: just test-loom
 
+      # A job step, not a post-job step, so the save runs before rust-cache's
+      # post-job cleanup deletes the sysroot. Only main saves, as caches are not
+      # shared across branches.
+      - name: Save sysroot cache
+        if: ${{ github.ref == 'refs/heads/main' && steps.sysroot-cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          path: |
+            src/tests/rust_guests/target/sysroot
+          key: ${{ steps.sysroot-cache.outputs.cache-primary-key }}
+
   windows-checks:
     if: ${{ inputs.docs_only == 'false' }}
     timeout-minutes: ${{ fromJSON(vars.CODE_CHECKS_JOB_TIMEOUT || '30') }}
@@ -122,8 +134,9 @@ jobs:
       # cargo-hyperlight builds a custom sysroot for x86_64-hyperlight-none target.
       # rust-cache cleans "anything not a dependency" from target dirs, removing the sysroot.
       # We cache sysroot separately to avoid rebuilding it (~10s) on every run.
-      - name: Sysroot cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+      - name: Restore sysroot cache
+        id: sysroot-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: |
             src/tests/rust_guests/target/sysroot
@@ -175,3 +188,14 @@ jobs:
         run: |
           just test-compilation-no-default-features debug
           just test-compilation-no-default-features release
+
+      # A job step, not a post-job step, so the save runs before rust-cache's
+      # post-job cleanup deletes the sysroot. Only main saves, as caches are not
+      # shared across branches.
+      - name: Save sysroot cache
+        if: ${{ github.ref == 'refs/heads/main' && steps.sysroot-cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          path: |
+            src/tests/rust_guests/target/sysroot
+          key: ${{ steps.sysroot-cache.outputs.cache-primary-key }}