[noahgift]

Closes #20. Part of the fleet-wide fix for paiml/infra#775; the infra-side guard is paiml/infra#778 (merged) and these call-site PRs go out alongside it so the nightly shared-cargo-home lane is never unpassable.

What was wrong

bench runs on [self-hosted, intel] and carried Swatinem/rust-cache@v2 with cache-bin: "false" — the paiml/infra#208 mitigation, which guards ${CARGO_HOME}/bin only.

cache-bin: false skips cleanBin and nothing else. The save step also runs cleanRegistry, unconditionally, deleting ${CARGO_HOME}/registry/src — the extracted crate sources every OTHER job on the box is compiling from. All 16 intel-clean-room-* runners share HOME=/home/noah.

Measured on intel 2026-09-19: eight save steps in 100 minutes; every crate directory under the shared registry with a birth time pinned to the second one of them finished; an infra cargo kani build killed mid-crate with could not parse/generate dep info ... No such file or directory. The step that killed it carried cache-bin: "false".

Change

• bench.yml: step deleted. cache-targets: true was the reason to keep it, but target/release here is a per-run directory on a persistent box and ~/.cargo persists between jobs by itself — the restore bought little and the save deleted other jobs' sources. The old comment block is replaced by the measurement.

• scripts/lint-rust-cache-guard.sh (new). This repo had no lint, and its own comment says why that mattered: "rmedia hit this four times and fixed it in its own workflows on 2026-08-17. This repo was never re-reviewed in that sweep — its last commit predates it — so the same landmine sat here on main." A rule enforced by review skips whatever nobody re-read.

  The lint refuses Swatinem/rust-cache and actions-rust-lang/setup-rust-toolchain (which wraps it) on any self-hosted job; exonerates only a job-private CARGO_HOME, because --target-dir, cargo install --root and a fresh $HOME do not move the sources out of the shared directory; prints its denominator; and NO-GOes on zero workflows or zero self-hosted jobs.

• make rust-cache-guard + a ci.yml step, selftest FIRST — once the step it guards is deleted the scan passes trivially, so the instrument has to be shown capable of failing before its green means anything.

Measured

$ make rust-cache-guard
  ok   a self-hosted rust-cache is rejected even with cache-bin: "false"
  ok   a self-hosted workflow with no cache action passes
  ok   no self-hosted job -> NO-GO, never a vacuous pass
  ok   a job-private CARGO_HOME is exonerated
lint-rust-cache-guard --selftest: OK (4 cases)
lint-rust-cache-guard: OK (0 $CARGO_HOME cache use(s) in 1 self-hosted workflow(s) of 3 scanned)

$ bash scripts/lint-rust-cache-guard.sh   # against main
ERROR: ./.github/workflows/bench.yml:103 uses a $CARGO_HOME cache action on a self-hosted job.

bashrs lint scripts/lint-rust-cache-guard.sh: 0 errors (and the script is added to the bashrs-lint target).

ci.yml and release.yml keep their rust-cache steps: both run on ubuntu-latest, where $HOME is ephemeral and the save step can only delete that runner's own copy.

🤖 Generated with Claude Code