[tgasser-nv]

Description

Since #2555 merged (2026-11-06, 13:52 UTC), every run of the Integration Tests and NeMo Relay plugin workflows has failed at startup, both on develop and on every PR. #2555 moved Swatinem/rust-cache from 6323deb (v2.9.2) to d1527c8 (v2.9.3). The repository's Actions policy only lets an action from outside GitHub run if it is on an allow-list. That list permits rust-cache at specific commits, including 6323deb but not d1527c8, so GitHub won't start either workflow.

This PR points rust-cache back to v2.9.2 in integration-tests.yml and relay-plugin.yml. Both files are identical to their state before #2555. v2.9.3 only fixes cache-timestamp pruning and changes a log message, so nothing is lost by going back.

Nobody noticed because a run that fails at startup doesn't create a check run. #2555's own run on 3 November failed this way, but nothing showed on the PR, and Integration Tests isn't a required check. As a result, #2565, #2566, #2567, #2573 and #2581 merged without integration tests. The develop run that follows this merge will cover them.

Follow-up: before we can take v2.9.3, the allow-list needs Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 added. Until then, close Dependabot's PR when it proposes the bump again.

Related Issue(s)

• Fixes #<issue_number>
• Issue assignee: @

Verification

• 6323deb102c322ba6fcbdcafc7e3dddab59af2b6 is the upstream v2.9.2 tag commit.
• I checked every action used under .github/ against the repository's allow-list (gh api repos/NVIDIA-NeMo/Guardrails/actions/permissions/selected-actions). rust-cache@6323deb matches an entry; rust-cache@d1527c8 matches none. Both affected workflows use rust-cache, and the workflows that don't use it still pass.
• uv run --locked pre-commit run --files .github/workflows/integration-tests.yml .github/workflows/relay-plugin.yml: passed, including zizmor.
• The Integration Tests and NeMo Relay plugin workflows should start and pass on this PR. Full Tests doesn't run because it ignores .github/**.
• Not checked: the organization-level Actions policy (I don't have access) and GitHub's exact refusal message, which a startup failure doesn't expose through the API. The diagnosis rests on the timing and the allow-list contents.

AI Assistance

• No AI tools were used.
• AI tools were used; a human reviewed and can explain every change (tool: Claude Code).

Checklist

• I've read the CONTRIBUTING guidelines.
• This PR links to a triaged issue assigned to me.
• My PR title follows the project commit convention.
• I've updated the documentation if applicable.
• I've added tests if applicable.
• I've noted any verification beyond CI and any checks I couldn't run.
• I did not update generated changelog files manually.
• I addressed all CodeRabbit, Greptile, and other review comments, or replied with why no change is needed.
• @mentions of the person or team responsible for reviewing proposed changes.

Summary by CodeRabbit

• Chores
  • Updated the pinned Cargo cache action version used in integration and relay-plugin workflows.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge; no actionable issues were found in either revision change.

Summary

Restores Swatinem/rust-cache to the v2.9.2 commit in both workflows to address the reported allow-list startup failures.

• Integration and Relay workflows use the allowed Rust cache action.

_{Reviews (1) · Last reviewed commit: "ci: revert Swatinem/rust-cache to allow-..." · Reviewed by Greptile}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Both GitHub Actions workflows now pin Swatinem/rust-cache to the v2.9.2 commit instead of v2.9.3. The cache configuration remains unchanged.

Changes: Cargo cache action pin

Layer / File(s)	Summary
Update workflow action pins .github/workflows/integration-tests.yml, .github/workflows/relay-plugin.yml	Both workflows now reference the v2.9.2 commit for Swatinem/rust-cache. The cache configuration is unchanged.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Possibly related PRs

• NVIDIA-NeMo/Guardrails#2536: Adds the two workflows whose Cargo cache action pins are updated here.

Suggested reviewers: pouyanpi, tanushriya910

Merge Risk: Minimal · up to 71745

This restores the allow-listed cache action version in two workflows so they can start. I found no behavioral risk in the change itself.

Architecture risk: Low · up to 71745

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/integration-tests.yml: The Cargo cache action pin changes from the v2.9.3 commit to the v2.9.2 commit; the job’s cache configuration is unchanged.
• observed — Modified behavior in .github/workflows/relay-plugin.yml: The Cargo cache action reference changed from the commit labeled v2.9.3 to the commit labeled v2.9.2.

Pre-merge checks: 6

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "ci: revert Swatinem/rust-cache to allow-listed v2.9.2" matches the main change. The PR pins Swatinem/rust-cache back to commit 6323deb (v2.9.2) in integration-tests.yml and relay-plugin.yml…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Test Results For Major Changes		The PR makes a minor change to the Rust cache action pin in two workflows. It does not change application numerics, convergence, or performance. The PR description also reports pre-commit results.

Full details: Title check

Explanation

The title "ci: revert Swatinem/rust-cache to allow-listed v2.9.2" matches the main change. The PR pins Swatinem/rust-cache back to commit 6323deb (v2.9.2) in integration-tests.yml and relay-plugin.yml, replacing d1527c8 (v2.9.3). The title names the action, the version, and the reason (the allow-list). The change is small and the title describes it accurately. The title is short, specific, and follows the conventional commit style.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: NVIDIA-NeMo/Guardrails
• Branch: ci/revert-rust-cache-2.9.2
• File: .coderabbit.yaml
• Commit: 71745af
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Enterprise
• Run ID: f764f1f4-e1c0-4982-8a56-023569dc50c8

Commits

Reviewing files that changed from the base of the PR and between c550266 and 71745af.

Files selected for processing: 2

• .github/workflows/integration-tests.yml
• .github/workflows/relay-plugin.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.