Wire up namespace and sccache for main CI path (ignoring publish-dry-run)

Author: graydon

.github/workflows/rust.yml

@@ -18,27 +18,42 @@ jobs:
     # changes to dependency specifications?
     # needs: [fmt, cackle, cargo-deny, check-git-rev-deps, build-and-test, publish-dry-run]
     needs: [fmt, cackle, cargo-deny, check-git-rev-deps, semver-checks, build-and-test]
-    runs-on: ubuntu-latest
+    runs-on:
+      - namespace-profile-noble-24-04-stellar-core-x64-small
     steps:
     - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
       run: exit 1
 
   fmt:
-    runs-on: ubuntu-latest
+    runs-on:
+      - namespace-profile-noble-24-04-stellar-core-x64-small
+    permissions:
+      contents: read
+      id-token: write
     steps:
-    - uses: actions/checkout@v3
+    - uses: namespacelabs/nscloud-setup@v0
+    - uses: namespacelabs/nscloud-checkout-action@v7
     - run: rustup update
     - run: cargo fmt --all --check
 
   cackle:
-    runs-on: ubuntu-latest
+    runs-on:
+      - namespace-profile-noble-24-04-stellar-core-x64-small
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: namespacelabs/nscloud-setup@v0
+      - uses: namespacelabs/nscloud-checkout-action@v7
       - uses: cackle-rs/cackle-action@997327f77e59d9cda7b0b6217f0fbdbd3f3ca904
       - run: cargo acl -n run
 
   cargo-deny:
-    runs-on: ubuntu-latest
+    runs-on:
+      - namespace-profile-noble-24-04-stellar-core-x64-small
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       matrix:
         checks:
@@ -47,24 +62,35 @@ jobs:
     # Prevent sudden announcement of a new advisory from failing ci:
     continue-on-error: ${{ matrix.checks == 'advisories' }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: namespacelabs/nscloud-setup@v0
+    - uses: namespacelabs/nscloud-checkout-action@v7
     - uses: EmbarkStudios/cargo-deny-action@76cd80eb775d7bbbd2d80292136d74d39e1b4918
       with:
         command: check ${{ matrix.checks }}
 
   check-git-rev-deps:
-    runs-on: ubuntu-latest
+    runs-on:
+      - namespace-profile-noble-24-04-stellar-core-x64-small
+    permissions:
+      contents: read
+      id-token: write
     steps:
-    - uses: actions/checkout@v3
+    - uses: namespacelabs/nscloud-setup@v0
+    - uses: namespacelabs/nscloud-checkout-action@v7
     - uses: stellar/actions/rust-check-git-rev-deps@main
 
   semver-checks:
     # When a PR enters the merge queue, the event context changes from pull_request to merge_group,
     # so github.event.pull_request becomes null/empty, so we don't do this check in the merge queue.
     if: "!contains( github.event.pull_request.labels.*.name, 'skip-semver-checks') && github.event_name != 'merge_group'"
-    runs-on: ubuntu-latest
+    runs-on:
+      - namespace-profile-noble-24-04-stellar-core-x64-small
+    permissions:
+      contents: read
+      id-token: write
     steps:
-    - uses: actions/checkout@v3
+    - uses: namespacelabs/nscloud-setup@v0
+    - uses: namespacelabs/nscloud-checkout-action@v7
     - run: rustup update
     - uses: stellar/binaries@v52
       with:
@@ -73,37 +99,41 @@ jobs:
     - run: cargo semver-checks --exclude soroban-simulation
 
   build-and-test:
+    runs-on:
+      - namespace-profile-noble-24-04-stellar-core-x64-large;overrides.cache-tag=config-${{ matrix.rust }}-${{ matrix.sys.target }}
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       matrix:
         rust: [msrv, latest]
         test-protocol: [26]
         sys:
-        - os: ubuntu-latest
-          target: wasm32-unknown-unknown
+        - target: wasm32-unknown-unknown
           guest-only: false
           test: false
-        - os: ubuntu-latest
-          target: wasm32v1-none
+        - target: wasm32v1-none
           guest-only: true
           test: false
-        - os: ubuntu-latest-16-cores
-          target: x86_64-unknown-linux-gnu
+        - target: x86_64-unknown-linux-gnu
           guest-only: false
           test: true
         # TODO: Re-enable these builds if we see value in doing so.
-        # - os: macos-latest
-        #   target: x86_64-apple-darwin
+        # - target: x86_64-apple-darwin
         #   test: true
-        # - os: macos-latest
-        #   target: aarch64-apple-darwin
+        # - target: aarch64-apple-darwin
         #   test: false
-        # - os: windows-latest
-        #   target: x86_64-pc-windows-msvc
+        # - target: x86_64-pc-windows-msvc
         #   test: true
-    runs-on: ${{ matrix.sys.os }}
     steps:
-    - uses: actions/checkout@v3
-    - uses: stellar/actions/rust-cache@main
+    - uses: namespacelabs/nscloud-setup@v0
+    - uses: namespacelabs/nscloud-checkout-action@v7
+    - uses: stellar/binaries@v52
+      with:
+        name: sccache
+        version: 0.14.0
+    - name: Configure sccache with Namespace cache
+      run: source setup-sccache.sh
     - name: Use the minimum supported Rust version
       if: matrix.rust == 'msrv'
       run: |
@@ -125,6 +155,9 @@ jobs:
       run: cargo hack --each-feature test --profile test-opt --locked --target ${{ matrix.sys.target }}
       env:
         TEST_PROTOCOL: ${{ matrix.test-protocol }}
+    - name: Show sccache stats
+      if: always()
+      run: sccache -s
 
   publish-dry-run:
     if: github.event_name == 'push' || startsWith(github.head_ref, 'release/')

setup-sccache.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Setup sccache with Namespace remote cache.
+#
+# This script is designed to be _sourced_ (not executed) so that
+# environment variables are set in the caller's shell:
+#
+#   source setup-sccache.sh
+#
+# It works in both CI (GitHub Actions) and local development.
+# Prerequisites: sccache and nsc must be on PATH.
+
+set -e
+
+# Check prerequisites
+for cmd in sccache nsc; do
+    if ! command -v "$cmd" >/dev/null 2>&1; then
+        echo "error: $cmd not found on PATH" >&2
+        return 1 2>/dev/null || exit 1
+    fi
+done
+
+# Get credentials from Namespace cache
+eval "$(nsc cache sccache setup --cache_name stellar)"
+
+# Export so the sccache daemon (and child processes) inherit them
+export SCCACHE_WEBDAV_ENDPOINT
+export SCCACHE_WEBDAV_KEY_PREFIX
+export SCCACHE_WEBDAV_TOKEN
+export SCCACHE_IDLE_TIMEOUT=0
+export RUSTC_WRAPPER=sccache
+
+# In GitHub Actions, propagate to subsequent steps and mask the token
+if [ -n "$GITHUB_ENV" ]; then
+    echo "::add-mask::$SCCACHE_WEBDAV_TOKEN"
+    echo "SCCACHE_WEBDAV_ENDPOINT=$SCCACHE_WEBDAV_ENDPOINT" >> "$GITHUB_ENV"
+    echo "SCCACHE_WEBDAV_KEY_PREFIX=$SCCACHE_WEBDAV_KEY_PREFIX" >> "$GITHUB_ENV"
+    echo "SCCACHE_WEBDAV_TOKEN=$SCCACHE_WEBDAV_TOKEN" >> "$GITHUB_ENV"
+    echo "SCCACHE_IDLE_TIMEOUT=0" >> "$GITHUB_ENV"
+    echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+fi
+
+# (Re)start the sccache daemon with the correct environment
+sccache --stop-server 2>/dev/null || true
+sccache --start-server
+
+echo "sccache configured with Namespace remote cache:"
+sccache -s