ci: cut CI time with trusted routing and Fireactions caches

.github/actions/build-production-binary/action.yml

@@ -20,6 +20,9 @@ inputs:
   sccache-writer-secret-access-key:
     description: "Protected writer secret"
     default: ""
+  sccache-local-tier:
+    description: "auto for host-local reads, or disabled for direct R2 maintenance"
+    default: "auto"
 
 runs:
   using: "composite"
@@ -33,6 +36,7 @@ runs:
         sccache-credential-mode: ${{ inputs.sccache-credential-mode }}
         sccache-writer-access-key-id: ${{ inputs.sccache-writer-access-key-id }}
         sccache-writer-secret-access-key: ${{ inputs.sccache-writer-secret-access-key }}
+        sccache-local-tier: ${{ inputs.sccache-local-tier }}
 
     - name: Require protected writer activation
       if: inputs.sccache-credential-mode == 'writer'
@@ -49,10 +53,20 @@ runs:
       if: inputs.arch == 'arm64'
       shell: bash
       run: |
-        cargo install cross \
-          --git https://github.com/cross-rs/cross \
-          --rev 64b5bb4d3d34de062552b9a2093affe77b4ad16a \
-          --locked
+        contract=/etc/fireactions-runner-image/image-contract.env
+        revision=64b5bb4d3d34de062552b9a2093affe77b4ad16a
+        system_bin=/usr/local/bin/cross
+        if [[ -r "$contract" ]] && \
+            grep -Fxq "CROSS_SOURCE_REVISION=$revision" "$contract" && \
+            [[ -x "$system_bin" ]] && "$system_bin" --version; then
+          install -m 0755 "$system_bin" "$HOME/.cargo/bin/cross"
+          echo "Using preinstalled cross from $revision"
+        else
+          cargo install cross \
+            --git https://github.com/cross-rs/cross \
+            --rev "$revision" \
+            --locked
+        fi
 
     - name: Build production binary
       shell: bash
@@ -108,3 +122,8 @@ runs:
 
         install -Dm0755 "$binary" "build/ci_target/${ARCH}/node-subtensor"
         echo "Staged $ARCH binary: $(du -h "build/ci_target/${ARCH}/node-subtensor" | cut -f1)"
+
+    - name: Report production compiler cache
+      if: always()
+      shell: bash
+      run: .github/scripts/sccache-report.sh "Production ${{ inputs.arch }} compiler cache"

.github/actions/run-typescript-e2e/action.yml

@@ -1,5 +1,5 @@
 name: Run TypeScript E2E suite
-description: Download a prebuilt node and run one Moonwall environment.
+description: Download a prebuilt node and run one or two isolated Moonwall environments.
 
 inputs:
   binary:
@@ -8,6 +8,10 @@ inputs:
   test:
     description: Moonwall environment to run.
     required: true
+  additional-test:
+    description: Optional second Moonwall environment to run after the first one exits.
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -41,12 +45,24 @@ runs:
       if: inputs.test == 'dev'
       shell: bash
       run: |
-        sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
-        sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends lsof
+        if ! command -v lsof >/dev/null 2>&1; then
+          sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
+          sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends lsof
+        fi
 
     - name: Run tests
       shell: bash
       working-directory: ts-tests
       env:
         MOONWALL_TEST: ${{ inputs.test }}
-      run: pnpm moonwall test "$MOONWALL_TEST"
+        MOONWALL_ADDITIONAL_TEST: ${{ inputs.additional-test }}
+      run: |
+        # The checked-in Moonwall file contains only canonical environments.
+        # Generate shard environments from the data manifest in this disposable
+        # checkout so local and CI topology cannot drift.
+        node scripts/e2e-shard-plan.mjs materialize moonwall.config.json e2e-shards.json
+        pnpm moonwall test "$MOONWALL_TEST"
+        if [[ -n "$MOONWALL_ADDITIONAL_TEST" ]]; then
+          echo "Starting isolated follow-up environment: $MOONWALL_ADDITIONAL_TEST"
+          pnpm moonwall test "$MOONWALL_ADDITIONAL_TEST"
+        fi

.github/actions/rust-setup/action.yml

@@ -1,6 +1,6 @@
 name: "Rust setup"
 description: >-
-  Common prologue for Rust jobs: system dependencies, stable toolchain,
+  Common prologue for Rust jobs: system dependencies, repository toolchain,
   shared R2 sccache, and Cargo registry/git caching.
 
 inputs:
@@ -25,11 +25,22 @@ inputs:
   sccache-writer-secret-access-key:
     description: "Protected writer secret; used only for an authorized source"
     default: ""
+  sccache-local-tier:
+    description: "auto to use a validated Fireactions host cache, or disabled for direct R2"
+    default: "auto"
 
 runs:
   using: "composite"
   steps:
+    - name: Detect preprovisioned Fireactions toolchain
+      id: runner-image
+      shell: bash
+      env:
+        RUST_SETUP_COMPONENTS: ${{ inputs.components }}
+      run: .github/scripts/rust-setup-preflight.sh "$GITHUB_OUTPUT"
+
     - name: Install system dependencies
+      if: steps.runner-image.outputs.system_ready != 'true'
       shell: bash
       run: |
         sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
@@ -39,10 +50,27 @@ runs:
           python3 python3-dev \
           ${{ inputs.extra-packages }}
 
-    - name: Install Rust (stable)
+    - name: Install extra system dependencies
+      if: steps.runner-image.outputs.system_ready == 'true' && inputs.extra-packages != ''
+      shell: bash
+      run: |
+        sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
+        sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y --no-install-recommends \
+          -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" \
+          ${{ inputs.extra-packages }}
+
+    - name: Bootstrap rustup when absent
+      if: >-
+        steps.runner-image.outputs.toolchain_ready != 'true' &&
+        steps.runner-image.outputs.rustup_ready != 'true'
       uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
-      with:
-        components: ${{ inputs.components }}
+
+    - name: Install repository Rust toolchain on image miss
+      if: steps.runner-image.outputs.toolchain_ready != 'true'
+      shell: bash
+      env:
+        RUST_SETUP_COMPONENTS: ${{ inputs.components }}
+      run: .github/scripts/install-rust-toolchain.sh "$RUST_SETUP_COMPONENTS"
 
     - name: Fast linker
       if: inputs.fast-linker == 'true'
@@ -52,7 +80,11 @@ runs:
         # links dozens of test binaries. Guarded so a runner image without
         # the mold package falls back to the default linker instead of
         # failing every Rust job at setup.
-        if sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends mold; then
+        # The production runner image already carries mold. Avoid consulting
+        # apt (whose package lists are intentionally removed from the image)
+        # when the linker is ready, while retaining the old-runner fallback.
+        if command -v mold >/dev/null 2>&1 || \
+            sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends mold; then
           mkdir -p "$HOME/.cargo"
           cat >> "$HOME/.cargo/config.toml" <<'EOF'
         [target.x86_64-unknown-linux-gnu]
@@ -89,5 +121,6 @@ runs:
       uses: ./.github/actions/sccache-setup
       with:
         credential-mode: ${{ inputs.sccache-credential-mode }}
+        local-tier: ${{ inputs.sccache-local-tier }}
         writer-access-key-id: ${{ inputs.sccache-writer-access-key-id }}
         writer-secret-access-key: ${{ inputs.sccache-writer-secret-access-key }}

.github/actions/sccache-setup/action.yml

@@ -11,6 +11,9 @@ inputs:
   writer-secret-access-key:
     description: "Protected Environment writer secret; used only for an authorized source"
     default: ""
+  local-tier:
+    description: "auto to use validated Fireactions host cache metadata, or disabled for direct R2"
+    default: "auto"
 
 outputs:
   enabled:
@@ -25,6 +28,7 @@ runs:
       shell: bash
       env:
         SCCACHE_CREDENTIAL_MODE: ${{ inputs.credential-mode }}
+        SCCACHE_LOCAL_TIER_MODE: ${{ inputs.local-tier }}
         AWS_ACCESS_KEY_ID: ${{ inputs.writer-access-key-id }}
         AWS_SECRET_ACCESS_KEY: ${{ inputs.writer-secret-access-key }}
       run: |
@@ -49,6 +53,7 @@ runs:
       env:
         SCCACHE_CONFIG_FILE: ${{ steps.prepare.outputs.config-file }}
         SCCACHE_INSTALL_OUTCOME: ${{ steps.install.outcome }}
+        SCCACHE_LOCAL_TIER_MODE: ${{ inputs.local-tier }}
       run: |
         "$GITHUB_ACTION_PATH/../../scripts/sccache-configure.sh" activate \
           "$SCCACHE_CONFIG_FILE" \

.github/actions/warm-native-cache/action.yml

@@ -0,0 +1,81 @@
+name: "Warm native Rust compiler cache"
+description: "Exercise the native Rust workloads whose compiler objects are reused by CI"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Warm default workspace check artifacts
+      shell: bash
+      env:
+        SKIP_WASM_BUILD: "1"
+      run: cargo check --workspace --locked
+
+    - name: Warm all-feature workspace check artifacts
+      shell: bash
+      env:
+        SKIP_WASM_BUILD: "1"
+      run: cargo check --workspace --all-features --locked
+
+    - name: Warm default clippy artifacts
+      shell: bash
+      env:
+        SKIP_WASM_BUILD: "1"
+      run: cargo clippy --workspace --all-targets --locked -- -D warnings
+
+    - name: Warm all-feature clippy artifacts
+      shell: bash
+      env:
+        SKIP_WASM_BUILD: "1"
+      run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+    - name: Warm deny-warnings check artifacts
+      shell: bash
+      env:
+        SKIP_WASM_BUILD: "1"
+      run: RUSTFLAGS="-D warnings" cargo check --locked
+
+    - name: Warm workspace test artifacts
+      shell: bash
+      env:
+        SKIP_WASM_BUILD: "1"
+      run: cargo test --workspace --all-features --locked --no-run
+
+    - name: Warm eco-tests artifacts
+      shell: bash
+      working-directory: eco-tests
+      run: cargo test --no-run
+
+    - name: Install runtime wasm toolchain components
+      shell: bash
+      run: |
+        rustup target add wasm32-unknown-unknown
+        rustup component add rust-src
+
+    - name: Warm try-runtime wasm artifacts
+      shell: bash
+      run: |
+        unset SKIP_WASM_BUILD
+        cargo build --profile production -p node-subtensor-runtime --features try-runtime -q --locked
+
+    - name: Warm release node artifacts
+      shell: bash
+      run: |
+        unset SKIP_WASM_BUILD
+        cargo build --release --locked -p node-subtensor
+
+    - name: Warm fast-runtime release node artifacts
+      shell: bash
+      run: |
+        unset SKIP_WASM_BUILD
+        cargo build --release --locked -p node-subtensor --features fast-runtime
+
+    # Package selection changes Cargo feature unification and therefore the
+    # rustc/sccache keys. Clean first so Cargo cannot satisfy this variant from
+    # the job-local target directory without exercising sccache.
+    - name: Warm runtime-only check artifacts
+      shell: bash
+      env:
+        SKIP_WASM_BUILD: "1"
+      run: |
+        cargo clean
+        cargo check --locked -p node-subtensor-runtime

.github/rust-ci-paths.txt

@@ -0,0 +1,13 @@
+chain-extensions
+common
+node
+pallets
+precompiles
+primitives
+runtime
+sdk/bittensor-core
+sdk/bittensor-core-py
+sdk/bittensor-core-wasm
+src
+support
+vendor

.github/scripts/benchmark-artifact-cache.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+: "${RUNNER_TEMP:?RUNNER_TEMP must be set}"
+: "${GITHUB_STEP_SUMMARY:?GITHUB_STEP_SUMMARY must be set}"
+: "${ARTIFACT_ID:?ARTIFACT_ID must be set}"
+: "${ARTIFACT_DIGEST:?ARTIFACT_DIGEST must be set}"
+: "${ARTIFACT_SIZE:?ARTIFACT_SIZE must be set}"
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+benchmark_dir="$RUNNER_TEMP/artifact-cache-benchmark"
+direct_output="$benchmark_dir/direct-output"
+first_output="$benchmark_dir/first-output"
+second_output="$benchmark_dir/second-output"
+rm -rf "$benchmark_dir"
+mkdir -p "$benchmark_dir"
+: > "$direct_output"
+: > "$first_output"
+: > "$second_output"
+
+FIREACTIONS_ARTIFACT_CACHE_DISABLE=true \
+  "$script_dir/download-artifact.sh" "$ARTIFACT_ID" mainnet-snapshot \
+    "$ARTIFACT_DIGEST" "$ARTIFACT_SIZE" "$benchmark_dir/direct" "$direct_output"
+"$script_dir/download-artifact.sh" "$ARTIFACT_ID" mainnet-snapshot \
+  "$ARTIFACT_DIGEST" "$ARTIFACT_SIZE" "$benchmark_dir/local-first" "$first_output"
+"$script_dir/download-artifact.sh" "$ARTIFACT_ID" mainnet-snapshot \
+  "$ARTIFACT_DIGEST" "$ARTIFACT_SIZE" "$benchmark_dir/local-second" "$second_output"
+
+direct_sha=$(sha256sum "$benchmark_dir/direct/mainnet-snapshot.tar.gz" | awk '{print $1}')
+first_sha=$(sha256sum "$benchmark_dir/local-first/mainnet-snapshot.tar.gz" | awk '{print $1}')
+second_sha=$(sha256sum "$benchmark_dir/local-second/mainnet-snapshot.tar.gz" | awk '{print $1}')
+[[ "$direct_sha" == "$first_sha" && "$direct_sha" == "$second_sha" ]]
+
+direct_seconds=$(sed -n 's/^seconds=//p' "$direct_output")
+first_seconds=$(sed -n 's/^seconds=//p' "$first_output")
+second_seconds=$(sed -n 's/^seconds=//p' "$second_output")
+first_source=$(sed -n 's/^source=//p' "$first_output")
+second_source=$(sed -n 's/^source=//p' "$second_output")
+[[ "$second_source" == local-hit ]]
+
+{
+  echo "### Mainnet snapshot artifact cache"
+  echo "- Artifact: $ARTIFACT_ID ($ARTIFACT_SIZE bytes)"
+  echo "- Direct GitHub: ${direct_seconds}s"
+  echo "- Cache-only probe 1: ${first_seconds}s ($first_source)"
+  echo "- Cache-only probe 2: ${second_seconds}s ($second_source)"
+  echo "- Extracted payload SHA-256: $second_sha"
+} >> "$GITHUB_STEP_SUMMARY"