[illuzen]

Summary

Adds Swatinem/rust-cache (pinned to d1527c8f…, v2.9.3) to every CI job that compiles Rust: fast-checks, test-workspace (both OSes), analysis, formal-bridge, slow-tests. security-audit already caches its own binary and advisory DB and is untouched.

Compilation dominates the test jobs today (the ~17 min test-workspace job spends only a few minutes running tests), and nothing is reused between runs. With the dependency build restored from cache, the job should drop to roughly the compile-time of the workspace crates themselves plus test time.

Design

• save-if: main only. PR runs restore main's cache but never save, so branches don't compete for the 10 GB per-repo quota or evict each other. Each job (and each OS in the matrix) has its own key; rust-cache prunes non-dependency artifacts before saving.
• cache-on-failure: true so a failing main run still seeds the dependency cache.
• formal-bridge now checks out qp-plonky2 before the cache step and lists both workspaces, so both target/ directories are keyed and restored. The step order change has no functional effect: the checkout does not depend on the traces, and the traces are written to formal/traces.
• fast-checks only installs taplo when it isn't already in the cached ~/.cargo/bin.
• CARGO_INCREMENTAL: 0 was already set globally, which is what rust-cache recommends.

What to expect

This PR's own CI run will not be faster: nothing has been saved to main yet, and PR branches don't save. The first run on main after merging seeds the caches; the next PR after that is where the speedup shows. I'll post before/after job timings there.

Verification

YAML parses; the only edits are inserted steps, the guarded taplo install, and the moved checkout block.

[n13]

Verdict: Approve
Reviewer: GPT-6.1 Sol

Reviewed head 10b652c9b74eba80e2edc3db31a1b02f31ae0b64 against base 080bc897108e4aed3e315ccd9229bbbbcdb1c9f2. No blocking findings.

Checked all five cache placements, the main-only save guard (including failure saves), job/OS/architecture isolation, the guarded taplo installation, and both formal-bridge workspace targets. Moving the qp-plonky2 checkout preserves the trace-generation and shape-reader commands. The pinned SHA resolves to rust-cache v2.9.3, and the inputs agree with its action definition.

Validation: actionlint 1.7.12 passed for .github/workflows/ci.yml (external ShellCheck/Pyflakes disabled); git diff --check passed. Rust tests were not rerun locally for this workflow-only change. GitHub's Actions CodeQL analysis and Lean formal-spec job have passed; the remaining CI jobs are still running. Cache-hit behavior and the resulting speedup remain unverified until main seeds the caches.