Trim redundant CI work

[btsouth]

What changes

• ci.yml: both Swatinem/rust-cache steps get save-if on main only. PRs still restore main's cache but no longer write new entries.
• dependabot.yml: cargo and github-actions updates are grouped, so each run opens one PR per ecosystem instead of one per dependency.
• warm-release-cache.yml: the Windows release build is skipped when the restore step reports an exact cache hit. The restore still runs, so a hit still refreshes the entry and keeps it from idle eviction. A lock or toolchain change changes the key, misses, and builds and saves as before.

Why

The warm-release-cache job ran a 12-19 min Windows build on exact hits, where the save is skipped, so it proved and stored nothing. PR-ref cache saves also crowd the 10 GB cache quota. See the CI audit findings F1 and F2.

Still runs

Frontend and Rust checks are unchanged (same job names, no path filters). release.yml is untouched. The warm job still checks out, sets up toolchains and computes the key on every trigger, and builds and saves on a miss.

---

Note

Low Risk
CI and Dependabot configuration only; test and release workflows still run on cache miss or non-main branches as before.

Overview
Reduces redundant CI and Dependabot churn without changing what actually gates merges.

Rust CI cache writes are limited to main: both Swatinem/rust-cache steps in ci.yml get save-if on the default branch. Pull requests still restore from main's cache but stop adding PR-scoped entries that eat the ~10 GB quota.

Dependabot groups weekly cargo and github-actions bumps so each ecosystem opens one combined PR (patterns: "*") instead of one per dependency.

Warm release cache skips the unsigned Windows release build when actions/cache/restore reports an exact key hit; restore still runs so the entry is refreshed against idle eviction. Lock or toolchain changes still miss, build, and save as before.

^{Reviewed by Cursor Bugbot for commit e9c66cf. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Trim redundant CI work: group Dependabot updates and limit cache saves

• Adds Dependabot groups cargo and github-actions in dependabot.yml so matching dependency updates are bundled into single PRs
• Restricts Rust cache saves in the rust-shared and rust-desktop CI jobs to runs on refs/heads/main; cache restores are unchanged
• In warm-release-cache.yml, the unsigned app build step is skipped on an exact cache hit (steps.cache-restore.outputs.cache-hit == 'true')
• Behavioral Change: PRs other than those targeting main no longer write new Rust cache entries; check the save-always/cache conditions in ci.yml

^{Macroscope summarized e9c66cf.}

Summary by CodeRabbit

• Chores
  • Dependabot updates are grouped by ecosystem.
  • CI now saves Rust caches only for runs on the main branch; other branches can still restore caches.
  • Release-cache workflows skip unsigned builds when an exact cache hit is available.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 67492266-1cdd-48ad-a896-dba42f920bff)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c19d05c4-6761-4209-96a1-c1c9ac8d66a6

📥 Commits

Reviewing files that changed from the base of the PR and between 31bf5c4 and e9c66cf.

📒 Files selected for processing (3)

• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/warm-release-cache.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependabot groups Cargo and GitHub Actions updates by ecosystem. CI Rust cache saves are limited to runs on the main branch. The unsigned application build skips execution when the release-cache restore has an exact hit.

Changes

Dependabot update grouping

Layer / File(s)	Summary
Group updates by ecosystem .github/dependabot.yml	Cargo and GitHub Actions updates each use a group that matches all packages with "*".

Workflow cache behavior

Layer / File(s)	Summary
Limit CI cache saves .github/workflows/ci.yml	The shared and desktop Rust cache steps save only when github.ref is refs/heads/main.
Skip builds on exact cache hits .github/workflows/warm-release-cache.yml	The unsigned application build runs only when the cache restore does not produce an exact hit.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to e9c66

These changes group dependency updates and reduce redundant cache work without removing PR cache restores or the release build. No actionable merge-blocking risk is evident.

Architecture Summary

Architecture risk: 🔵 Low · up to e9c66

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/dependabot.yml: Adds a Cargo update group matching all packages with the "*" pattern.
• observed — Modified behavior in .github/dependabot.yml: Adds a GitHub Actions update group matching all packages with the "*" pattern.
• observed — Modified behavior in .github/workflows/ci.yml: The shared Rust cache now saves only when github.ref is refs/heads/main.
• observed — Modified behavior in .github/workflows/ci.yml: The desktop Rust cache now saves only when github.ref is refs/heads/main.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	“Trim redundant CI work” clearly summarizes the main changes to CI cache saves and warm-cache builds. It also reasonably covers the Dependabot grouping change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ceiling	e9c66cf	Commit Preview URL Branch Preview URL	Oct 06 2026, 04:03 AM