ci: stop sccache flooding the Actions cache quota

.github/actions/setup-rust/action.yml

@@ -15,6 +15,13 @@ inputs:
       lint). Pass 'true' for the cache-writer, leave 'false' elsewhere.
     required: false
     default: "false"
+  shared-key:
+    description: >-
+      Optional rust-cache shared-key. Set it to give a job its own cache
+      namespace instead of the per-job default — e.g. the release maturin build
+      keeps its release-profile target/ separate from the lint job's dev cache.
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -32,6 +39,7 @@ runs:
         # that responds as `rustup-init`. Proxies are reinstalled each run by
         # dtolnay/rust-toolchain. https://github.com/Swatinem/rust-cache/issues/16
         save-if: ${{ inputs.save-if }}
+        shared-key: ${{ inputs.shared-key }}
         cache-bin: false
         # Bump to evict any v0-* caches that already contain the corrupted bin dir.
         prefix-key: v1-rust-bin-fix

.github/workflows/ci-python.yml

@@ -76,24 +76,16 @@ jobs:
       - name: Set up Rust
         uses: ./.github/actions/setup-rust
         with:
-          # Only the non-Linux runners save the cache here; the Linux Cargo
-          # cache is written by the Rust lint job.
-          save-if: ${{ matrix.os != 'ubuntu-latest' }}
-
-      - name: Set up sccache
-        uses: mozilla-actions/sccache-action@v0.0.9
+          # Cache the release-profile target/ under its own `release` namespace,
+          # kept apart from the lint job's dev-profile cache. Master is the sole
+          # writer (one consolidated entry per OS); PRs restore read-only so they
+          # never mint per-PR caches. Replaces the old sccache GHA backend, which
+          # wrote one cache entry per compiled object and flooded the 10 GB quota.
+          shared-key: release
+          save-if: ${{ github.ref == 'refs/heads/master' }}
 
       - name: Build native extension with maturin
         uses: PyO3/maturin-action@v1.51.0
-        # Step-scoped on purpose: a job-level RUSTC_WRAPPER poisons the
-        # uv-sync editable build inside setup-python, which runs before the
-        # sccache binary exists on the runner.
-        env:
-          # Share compiled rustc artifacts across the matrix's release builds
-          # via the GitHub Actions cache. The Cargo cache written by the Rust
-          # lint job is dev-profile, so these builds got near-zero reuse.
-          SCCACHE_GHA_ENABLED: "true"
-          RUSTC_WRAPPER: "sccache"
         with:
           command: develop
           args: --release --features extension-module,postgres,redis,native-async,workflows,mesh

.github/workflows/ci-rust.yml

@@ -29,7 +29,10 @@ jobs:
         uses: ./.github/actions/setup-rust
         with:
           components: rustfmt, clippy
-          save-if: "true" # the Rust lint job is the sole Cargo cache writer
+          # Sole dev-cache writer, and only on master: a PR-ref cache can't be
+          # read by other PRs anyway, so saving on PRs just mints throwaway
+          # entries against the 10 GB quota. PRs restore master's cache instead.
+          save-if: ${{ github.ref == 'refs/heads/master' }}
 
       - name: Check Rust formatting
         run: cargo fmt --all --check