ci: route all Linux jobs to incredibuild-runner

.github/workflows/bench.yml

@@ -5,6 +5,10 @@ on:
         required: false
         type: string
         default: "true"
+  # Allow manual dispatch on this fork so we can validate ib_console
+  # acceleration on cargo run benchmarks without needing main-branch
+  # pushes or rust file changes.
+  workflow_dispatch:
 
 permissions: {}
 
@@ -18,7 +22,15 @@ jobs:
   benchmarks-walltime-build:
     name: "walltime build"
     # codspeed-macro doesn't support Ubuntu 24.04 yet
-    runs-on: depot-ubuntu-22.04-arm-4
+    runs-on: incredibuild-runner
+    env:
+      # Per-job CARGO_HOME / CARGO_TARGET_DIR. Without this the IB
+      # runner shares /ib-workspace/cache/cargo* across concurrent
+      # jobs, leading to NUL-byte source corruption (indexmap,
+      # rkyv_derive) under workspace-scale compilation. ib_console
+      # build cache (separate) still accelerates compile.
+      CARGO_HOME: ${{ github.workspace }}/.cargo
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     if: ${{ github.repository == 'astral-sh/uv' }}
     timeout-minutes: 20
     steps:
@@ -43,9 +55,9 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y libsasl2-dev libldap2-dev libkrb5-dev
-          cargo run --bin uv -- venv --cache-dir .cache
-          cargo run --bin uv -- pip compile test/requirements/jupyter.in --universal --exclude-newer 2024-08-08 --cache-dir .cache
-          cargo run --bin uv -- pip compile test/requirements/airflow.in --universal --exclude-newer 2024-08-08 --cache-dir .cache
+          ./scripts/cargo-ib.sh run --bin uv -- venv --cache-dir .cache
+          ./scripts/cargo-ib.sh run --bin uv -- pip compile test/requirements/jupyter.in --universal --exclude-newer 2024-08-08 --cache-dir .cache
+          ./scripts/cargo-ib.sh run --bin uv -- pip compile test/requirements/airflow.in --universal --exclude-newer 2024-08-08 --cache-dir .cache
 
       - name: "Build benchmarks"
         run: cargo codspeed build -m walltime --profile profiling -p uv-bench
@@ -96,7 +108,15 @@ jobs:
 
   benchmarks-simulated:
     name: "simulated"
-    runs-on: depot-ubuntu-24.04-4
+    runs-on: incredibuild-runner
+    env:
+      # Per-job CARGO_HOME / CARGO_TARGET_DIR. Without this the IB
+      # runner shares /ib-workspace/cache/cargo* across concurrent
+      # jobs, leading to NUL-byte source corruption (indexmap,
+      # rkyv_derive) under workspace-scale compilation. ib_console
+      # build cache (separate) still accelerates compile.
+      CARGO_HOME: ${{ github.workspace }}/.cargo
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     if: ${{ github.repository == 'astral-sh/uv' }}
     timeout-minutes: 20
     steps:
@@ -121,9 +141,9 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y libsasl2-dev libldap2-dev libkrb5-dev
-          cargo run --bin uv -- venv --cache-dir .cache
-          cargo run --bin uv -- pip compile test/requirements/jupyter.in --universal --exclude-newer 2024-08-08 --cache-dir .cache
-          cargo run --bin uv -- pip compile test/requirements/airflow.in --universal --exclude-newer 2024-08-08 --cache-dir .cache
+          ./scripts/cargo-ib.sh run --bin uv -- venv --cache-dir .cache
+          ./scripts/cargo-ib.sh run --bin uv -- pip compile test/requirements/jupyter.in --universal --exclude-newer 2024-08-08 --cache-dir .cache
+          ./scripts/cargo-ib.sh run --bin uv -- pip compile test/requirements/airflow.in --universal --exclude-newer 2024-08-08 --cache-dir .cache
 
       - name: "Build benchmarks"
         run: cargo codspeed build --profile profiling -p uv-bench

.github/workflows/build-dev-binaries.yml

@@ -18,7 +18,16 @@ jobs:
   build-binary-linux-libc:
     name: "linux libc"
     timeout-minutes: 10
-    runs-on: github-ubuntu-24.04-x86_64-8
+    runs-on: incredibuild-runner
+    env:
+      # Per-job CARGO_HOME / CARGO_TARGET_DIR. Without this the IB
+      # runner shares /ib-workspace/cache/cargo* across concurrent
+      # jobs and produces "found invalid metadata files" / "unclosed
+      # delimiter" corruption (rkyv_derive, indexmap, etc.). IB's
+      # ib_console build cache (separate from CARGO_TARGET_DIR) still
+      # accelerates compile across runs.
+      CARGO_HOME: ${{ github.workspace }}/.cargo
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -32,7 +41,7 @@ jobs:
           save-if: ${{ inputs.save-rust-cache == 'true' }}
 
       - name: "Build"
-        run: cargo build --profile no-debug
+        run: ./scripts/cargo-ib.sh build --profile no-debug
 
       - name: "Upload binary"
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -46,7 +55,16 @@ jobs:
   build-binary-linux-aarch64:
     name: "linux aarch64"
     timeout-minutes: 10
-    runs-on: github-ubuntu-24.04-aarch64-4
+    runs-on: incredibuild-runner
+    env:
+      # Per-job CARGO_HOME / CARGO_TARGET_DIR. Without this the IB
+      # runner shares /ib-workspace/cache/cargo* across concurrent
+      # jobs and produces "found invalid metadata files" / "unclosed
+      # delimiter" corruption (rkyv_derive, indexmap, etc.). IB's
+      # ib_console build cache (separate from CARGO_TARGET_DIR) still
+      # accelerates compile across runs.
+      CARGO_HOME: ${{ github.workspace }}/.cargo
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -60,7 +78,7 @@ jobs:
           save-if: ${{ inputs.save-rust-cache == 'true' }}
 
       - name: "Build"
-        run: cargo build --profile no-debug
+        run: ./scripts/cargo-ib.sh build --profile no-debug
 
       - name: "Upload binary"
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -74,19 +92,31 @@ jobs:
   build-binary-linux-armv7-gnueabihf:
     name: "linux armv7 gnueabihf"
     timeout-minutes: 15
-    runs-on: github-ubuntu-24.04-x86_64-8
+    runs-on: incredibuild-runner
+    env:
+      # Per-job CARGO_HOME / CARGO_TARGET_DIR. Without this the IB
+      # runner shares /ib-workspace/cache/cargo* across concurrent
+      # jobs and produces "found invalid metadata files" / "unclosed
+      # delimiter" corruption (rkyv_derive, indexmap, etc.). IB's
+      # ib_console build cache (separate from CARGO_TARGET_DIR) still
+      # accelerates compile across runs.
+      CARGO_HOME: ${{ github.workspace }}/.cargo
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
+      - name: "Bootstrap baseline tools"
+        run: ./scripts/ensure-ci-tools.sh
+
       - name: "Install mold"
         run: ./scripts/install-mold.sh
 
       - name: "Setup armv7"
         run: |
           sudo apt-get update
-          sudo apt-get install gcc-arm-linux-gnueabihf
+          sudo apt-get install -y gcc-arm-linux-gnueabihf
           rustup target add armv7-unknown-linux-gnueabihf
 
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
@@ -96,7 +126,7 @@ jobs:
       - name: "Build"
         env:
           CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER: arm-linux-gnueabihf-gcc
-        run: cargo build --profile no-debug --target armv7-unknown-linux-gnueabihf --bin uv --bin uvx
+        run: ./scripts/cargo-ib.sh build --profile no-debug --target armv7-unknown-linux-gnueabihf --bin uv --bin uvx
 
       - name: "Upload binary"
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -110,26 +140,39 @@ jobs:
   build-binary-linux-musl:
     name: "linux musl"
     timeout-minutes: 10
-    runs-on: github-ubuntu-24.04-x86_64-8
+    runs-on: incredibuild-runner
+    env:
+      # Per-job CARGO_HOME / CARGO_TARGET_DIR. Without this the IB
+      # runner shares /ib-workspace/cache/cargo* across concurrent
+      # jobs and produces "found invalid metadata files" / "unclosed
+      # delimiter" corruption (rkyv_derive, indexmap, etc.). IB's
+      # ib_console build cache (separate from CARGO_TARGET_DIR) still
+      # accelerates compile across runs.
+      CARGO_HOME: ${{ github.workspace }}/.cargo
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
+      - name: "Bootstrap baseline tools"
+        run: ./scripts/ensure-ci-tools.sh
+
       - name: "Install mold"
         run: ./scripts/install-mold.sh
 
       - name: "Setup musl"
         run: |
-          sudo apt-get install musl-tools
+          sudo apt-get update
+          sudo apt-get install -y musl-tools
           rustup target add x86_64-unknown-linux-musl
 
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           save-if: ${{ inputs.save-rust-cache == 'true' }}
 
       - name: "Build"
-        run: cargo build --profile no-debug --target x86_64-unknown-linux-musl --bin uv --bin uvx
+        run: ./scripts/cargo-ib.sh build --profile no-debug --target x86_64-unknown-linux-musl --bin uv --bin uvx
 
       - name: "Upload binary"
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -260,8 +303,17 @@ jobs:
 
   build-binary-msrv:
     name: "msrv"
-    runs-on: github-ubuntu-24.04-x86_64-8
+    runs-on: incredibuild-runner
     timeout-minutes: 10
+    env:
+      # Pin per-job CARGO_HOME and CARGO_TARGET_DIR. Incredibuild's
+      # shared cargo registry cache occasionally produces corrupted
+      # .crate sources (NUL-byte garbage in `indexmap` etc.) when
+      # multiple Linux jobs write the same crate concurrently.
+      # Job-local dirs cost a fresh `cargo fetch` but eliminate the
+      # corruption race for this MSRV smoke build.
+      CARGO_HOME: ${{ github.workspace }}/.cargo
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -280,21 +332,53 @@ jobs:
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           save-if: ${{ inputs.save-rust-cache == 'true' }}
-      - run: cargo +${MSRV} build --profile no-debug
+      - run: ./scripts/cargo-ib.sh +${MSRV} build --profile no-debug --bin uv
+        env:
+          MSRV: ${{ steps.msrv.outputs.value }}
+      # Use `cargo run` instead of `./target/...` so the path resolves
+      # via cargo metadata regardless of CARGO_TARGET_DIR overrides
+      # (Incredibuild Hosted Build Runner sets a shared target dir).
+      - run: ./scripts/cargo-ib.sh +${MSRV} run --profile no-debug --bin uv -- --version
         env:
           MSRV: ${{ steps.msrv.outputs.value }}
-      - run: ./target/no-debug/uv --version
 
   build-binary-android-aarch64:
     name: "android aarch64"
-    timeout-minutes: 10
-    runs-on: github-ubuntu-24.04-x86_64-8
+    timeout-minutes: 15
+    runs-on: incredibuild-runner
+    env:
+      # Per-job CARGO_HOME / CARGO_TARGET_DIR. Without this the IB
+      # runner shares /ib-workspace/cache/cargo* across concurrent
+      # jobs and produces "found invalid metadata files" / "unclosed
+      # delimiter" corruption (rkyv_derive, indexmap, etc.). IB's
+      # ib_console build cache (separate from CARGO_TARGET_DIR) still
+      # accelerates compile across runs.
+      CARGO_HOME: ${{ github.workspace }}/.cargo
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
+      - name: "Bootstrap baseline tools"
+        run: ./scripts/ensure-ci-tools.sh
+
+      - name: "Install Android NDK"
+        # Lean self-hosted runners (e.g. Incredibuild Hosted Build Runner)
+        # don't ship the Android SDK/NDK that ubuntu-latest preinstalls.
+        # `nttld/setup-ndk` downloads it on-demand. We capture its
+        # `ndk-path` output explicitly because the action's
+        # `core.exportVariable('ANDROID_NDK_ROOT', ...)` doesn't propagate
+        # reliably on this runner — relying on the output is more robust.
+        id: setup-ndk
+        uses: nttld/setup-ndk@afb4c9964b521afb97c864b7d40b11e6911bd410 # v1.5.0
+        with:
+          ndk-version: r26d
+          add-to-path: false
+
       - name: "Setup Android NDK"
+        env:
+          ANDROID_NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
         run: |
           # Use ANDROID_NDK_ROOT if set, otherwise find the latest installed NDK
           if [ -z "${ANDROID_NDK_ROOT}" ]; then
@@ -324,7 +408,7 @@ jobs:
           save-if: ${{ inputs.save-rust-cache == 'true' }}
 
       - name: "Build"
-        run: cargo build --profile no-debug --target aarch64-linux-android --bin uv --bin uvx
+        run: ./scripts/cargo-ib.sh build --profile no-debug --target aarch64-linux-android --bin uv --bin uvx
 
       - name: "Upload binary"
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -338,6 +422,9 @@ jobs:
   build-binary-freebsd:
     name: "freebsd"
     timeout-minutes: 10
+    # Runs FreeBSD tests inside a Firecracker microVM; requires nested
+    # virtualization + privileged Docker which Incredibuild's
+    # containerized runner can't provide. Keep on GitHub-hosted Linux.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -349,7 +436,7 @@ jobs:
       - name: "Cross build"
         run: |
           # Install cross from `freebsd-firecracker`
-          wget -q -O cross https://github.com/acj/freebsd-firecracker/releases/download/v0.0.10/cross
+          curl --proto '=https' --tlsv1.2 -fsSL -o cross https://github.com/acj/freebsd-firecracker/releases/download/v0.0.10/cross
           chmod +x cross
           mv cross /usr/local/bin/cross