sdk%fix(ci): narrow CodeQL cache, place 100 commit limit per PR, update codecov scope, restore MSRV artifact caching, try to fix false-fail due to concurrent runs

.github/ci.env

@@ -0,0 +1 @@
+MAX_PR_COMMITS=100

.github/scripts/pr_comment.js

@@ -6,9 +6,13 @@
 
 // @ts-check
 
-const { getMergeableState, listOpenPulls } = require("./util");
+const { getPullDetail, listOpenPulls } = require("./util");
 
 const COMMENT_TAG = "<!-- pr-status-bot -->";
+const MAX_COMMITS = Number.parseInt(process.env.MAX_PR_COMMITS, 10);
+if (!Number.isFinite(MAX_COMMITS) || MAX_COMMITS <= 0) {
+  throw new Error(`MAX_PR_COMMITS must be a positive integer (got: ${process.env.MAX_PR_COMMITS})`);
+}
 
 /**
  * @param {{ github: import("@actions/github").getOctokit, context: import("@actions/github").context }} params
@@ -53,8 +57,8 @@ async function buildFileCache({ github, owner, repo, pulls }) {
  * @returns {Promise<string>}
  */
 async function buildComment({ github, owner, repo, pr, pulls, fileCache }) {
-  const mergeableState = await getMergeableState({ github, owner, repo, prNumber: pr.number });
-  const isDirty = mergeableState === "dirty";
+  const detail = await getPullDetail({ github, owner, repo, prNumber: pr.number });
+  const isDirty = detail.mergeable_state === "dirty";
 
   const ourFiles = new Set(fileCache.get(pr.number) || []);
   const potentialConflicts = [];
@@ -70,14 +74,21 @@ async function buildComment({ github, owner, repo, pr, pulls, fileCache }) {
     }
   }
 
-  let banner;
+  let banner = "";
+  if (detail.commits > MAX_COMMITS) {
+    banner +=
+      "> [!CAUTION]\n" +
+      `> This pull request has more than ${MAX_COMMITS} commits. Large pull requests are difficult to review. Consider splitting\n` +
+      "> your changes into smaller pull requests. Some Action runners will terminate until this is resolved.\n\n";
+  }
+
   if (isDirty) {
-    banner = "> [!CAUTION]\n> This pull request conflicts with the base branch. Please rebase and force-push.";
+    banner += "> [!CAUTION]\n> This pull request conflicts with the base branch. Please rebase and force-push.";
   } else if (potentialConflicts.length > 0) {
-    banner =
+    banner +=
       "> [!WARNING]\n> This pull request may have conflicts, please coordinate with the authors of these pull requests.";
   } else {
-    banner = "> [!NOTE]\n> This pull request has no conflicts! 🎊 🎉 🎊";
+    banner += "> [!NOTE]\n> This pull request has no conflicts! 🎊 🎉 🎊";
   }
 
   let conflictSection = "";

.github/scripts/pr_tag.js

@@ -6,7 +6,7 @@
 
 // @ts-check
 
-const { getMergeableState, listOpenPulls } = require("./util");
+const { getPullDetail, listOpenPulls } = require("./util");
 
 const STALE_DAYS = 60;
 
@@ -56,13 +56,13 @@ module.exports = async ({ github, context }) => {
       console.log(`PR #${pr.number}: removed stale`);
     }
 
-    const mergeableState = await getMergeableState({ github, owner, repo, prNumber: pr.number });
+    const detail = await getPullDetail({ github, owner, repo, prNumber: pr.number });
 
-    if (mergeableState === "unknown") {
+    if (detail.mergeable_state === "unknown") {
       continue;
     }
 
-    const hasConflicts = mergeableState === "dirty";
+    const hasConflicts = detail.mergeable_state === "dirty";
     const hasRebaseLabel = labels.includes(Labels.NEEDS_REBASE);
 
     if (hasConflicts && !hasRebaseLabel) {

.github/scripts/util.js

@@ -37,21 +37,23 @@ async function listOpenPulls({ github, owner, repo }) {
 
 /**
  * @param {{ github: any, owner: string, repo: string, prNumber: number }} params
- * @returns {Promise<string>}
+ * @returns {Promise<{ mergeable_state: string, commits: number }>}
  */
-async function getMergeableState({ github, owner, repo, prNumber }) {
+async function getPullDetail({ github, owner, repo, prNumber }) {
+  let commits = 0;
   for (let i = 0; i < MERGEABLE_RETRIES; i++) {
     const { data: detail } = await github.rest.pulls.get({
       owner,
       repo,
       pull_number: prNumber,
     });
+    commits = detail.commits;
     if (detail.mergeable_state !== "unknown") {
-      return detail.mergeable_state;
+      return { mergeable_state: detail.mergeable_state, commits };
     }
     await sleep(MERGEABLE_DELAY_MS);
   }
-  return "unknown";
+  return { mergeable_state: "unknown", commits };
 }
 
-module.exports = { BASE_BRANCH, getMergeableState, listOpenPulls, sleep };
+module.exports = { BASE_BRANCH, getPullDetail, listOpenPulls, sleep };

.github/workflows/build_msrv.yml

@@ -21,7 +21,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          fetch-depth: 0
+          fetch-depth: 100
+
+      - name: Run pull request checks
+        if: github.event_name == 'pull_request'
+        shell: bash
+        run: |
+          source .github/ci.env
+          commits=${{ github.event.pull_request.commits }}
+          if [ "${commits}" -gt "${MAX_PR_COMMITS}" ]; then
+            echo "::error::PR has ${commits} commits (limit: ${MAX_PR_COMMITS})"
+            exit 1
+          fi
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@1.85.0
@@ -57,27 +68,23 @@ jobs:
           key: cargo-deps-${{ hashFiles('Cargo.lock') }}
           restore-keys: cargo-deps-
 
-      - name: Restore CodeQL caches
-        id: codeql-cache
+      - name: Restore build artifacts
         uses: actions/cache/restore@v5
         with:
-          path: |
-            contrib/codeql/.cache
-            ~/.codeql
-          key: codeql-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pkgs/**/*.rs', 'contrib/codeql/**/*.ql', 'contrib/codeql/**/*.qll', 'Cargo.lock') }}
+          path: target
+          key: cargo-build-msrv-${{ runner.os }}-${{ runner.arch }}-${{ github.sha }}
+          restore-keys: |
+            cargo-build-msrv-${{ runner.os }}-${{ runner.arch }}-
+
+      - name: Manage CodeQL packs
+        uses: actions/cache@v5
+        with:
+          path: ~/.codeql
+          key: codeql-packs-${{ hashFiles('contrib/codeql/codeql-pack.lock.yml') }}
 
       - name: Run linters
         run: python3 contrib/lint/all_lint.py
 
-      - name: Save CodeQL caches
-        if: success() && steps.codeql-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
-        with:
-          path: |
-            contrib/codeql/.cache
-            ~/.codeql
-          key: codeql-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pkgs/**/*.rs', 'contrib/codeql/**/*.ql', 'contrib/codeql/**/*.qll', 'Cargo.lock') }}
-
       - name: Check PR commit messages
         if: github.event_name == 'pull_request'
         run: >
@@ -86,11 +93,24 @@ jobs:
 
   build:
     name: Build and test
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Run pull request checks
+        if: github.event_name == 'pull_request'
+        shell: bash
+        run: |
+          source .github/ci.env
+          commits=${{ github.event.pull_request.commits }}
+          if [ "${commits}" -gt "${MAX_PR_COMMITS}" ]; then
+            echo "::error::PR has ${commits} commits (limit: ${MAX_PR_COMMITS})"
+            exit 1
+          fi
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@1.85.0
@@ -104,6 +124,14 @@ jobs:
           key: cargo-deps-${{ hashFiles('Cargo.lock') }}
           restore-keys: cargo-deps-
 
+      - name: Manage build artifacts
+        uses: actions/cache@v5
+        with:
+          path: target
+          key: cargo-build-msrv-${{ runner.os }}-${{ runner.arch }}-${{ github.sha }}
+          restore-keys: |
+            cargo-build-msrv-${{ runner.os }}-${{ runner.arch }}-
+
       - name: Build workspace
         run: cargo build --workspace --features full,_internal
 

.github/workflows/build_nightly.yml

@@ -34,6 +34,17 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Run pull request checks
+        if: github.event_name == 'pull_request'
+        shell: bash
+        run: |
+          source .github/ci.env
+          commits=${{ github.event.pull_request.commits }}
+          if [ "${commits}" -gt "${MAX_PR_COMMITS}" ]; then
+            echo "::error::PR has ${commits} commits (limit: ${MAX_PR_COMMITS})"
+            exit 1
+          fi
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
         with:
@@ -43,16 +54,16 @@ jobs:
       - name: Install cargo-llvm-cov
         uses: taiki-e/install-action@cargo-llvm-cov
 
-      - name: Restore cargo registry
-        uses: actions/cache/restore@v5
+      - name: Manage cargo registry
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
           key: cargo-deps-${{ hashFiles('Cargo.lock') }}
           restore-keys: cargo-deps-
 
-      - name: Restore build artifacts
+      - name: Manage build artifacts
         uses: actions/cache@v5
         with:
           path: target
@@ -88,12 +99,3 @@ jobs:
 
       - name: Sanity check benchmarks
         run: cargo bench -p ${{ inputs.package }} --features ${{ inputs.features }} --no-run
-
-      - name: Save cargo registry
-        if: always()
-        uses: actions/cache/save@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-deps-${{ hashFiles('Cargo.lock') }}

.github/workflows/build_stable.yml

@@ -42,19 +42,30 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Run pull request checks
+        if: github.event_name == 'pull_request'
+        shell: bash
+        run: |
+          source .github/ci.env
+          commits=${{ github.event.pull_request.commits }}
+          if [ "${commits}" -gt "${MAX_PR_COMMITS}" ]; then
+            echo "::error::PR has ${commits} commits (limit: ${MAX_PR_COMMITS})"
+            exit 1
+          fi
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Restore cargo registry
-        uses: actions/cache/restore@v5
+      - name: Manage cargo registry
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
           key: cargo-deps-${{ hashFiles('Cargo.lock') }}
           restore-keys: cargo-deps-
 
-      - name: Restore build artifacts
+      - name: Manage build artifacts
         uses: actions/cache@v5
         with:
           path: target
@@ -67,12 +78,3 @@ jobs:
 
       - name: Test package
         run: cargo test -p ${{ inputs.package }} --features ${{ inputs.features }}
-
-      - name: Save cargo registry
-        if: always()
-        uses: actions/cache/save@v5
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-deps-${{ hashFiles('Cargo.lock') }}

.github/workflows/pr_comment.yml

@@ -1,10 +1,10 @@
 name: Comment on PRs
 
 on:
-  push:
-    branches: [develop]
   pull_request_target:
     types: [synchronize, opened, reopened, closed]
+  schedule:
+    - cron: "0 6 * * 1"
 
 concurrency:
   group: ${{ github.workflow }}
@@ -24,6 +24,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Read environment
+        run: cat .github/ci.env >> "$GITHUB_ENV"
+
       - name: Update PR comments
         uses: actions/github-script@v8
         with:

.github/workflows/pr_tag.yml

@@ -1,10 +1,8 @@
 name: Tag PRs
 
 on:
-  push:
-    branches: [develop]
   pull_request_target:
-    types: [synchronize, opened, reopened]
+    types: [synchronize, opened, reopened, closed]
   schedule:
     - cron: "0 6 * * 1"