SRE-805: Install Rust-ecosystem CI tools from GitHub releases via mise aqua backend#9017
Draft
claude[bot] wants to merge 4 commits into
Draft
SRE-805: Install Rust-ecosystem CI tools from GitHub releases via mise aqua backend#9017claude[bot] wants to merge 4 commits into
claude[bot] wants to merge 4 commits into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9017 +/- ##
=======================================
Coverage 59.73% 59.73%
=======================================
Files 1371 1371
Lines 135461 135461
Branches 6066 6066
=======================================
+ Hits 80911 80914 +3
+ Misses 53618 53615 -3
Partials 932 932
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
TimDiekmann
reviewed
Jul 13, 2026
TimDiekmann
left a comment
Member
There was a problem hiding this comment.
Your re-trigger commit is not validated. Either run it validated or find another way.
e17f315 to
f2f4db0
Compare
Contributor
Benchmark results
|
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 2002 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 1002 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 3314 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 1527 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 2078 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 1033 | Flame Graph |
policy_resolution_medium
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 102 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 52 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 269 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 108 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 133 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 63 | Flame Graph |
policy_resolution_none
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 2 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 2 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 8 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 3 | Flame Graph |
policy_resolution_small
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 52 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 26 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 94 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 27 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 66 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 29 | Flame Graph |
read_scaling_complete
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id;one_depth | 1 entities | Flame Graph | |
| entity_by_id;one_depth | 10 entities | Flame Graph | |
| entity_by_id;one_depth | 25 entities | Flame Graph | |
| entity_by_id;one_depth | 5 entities | Flame Graph | |
| entity_by_id;one_depth | 50 entities | Flame Graph | |
| entity_by_id;two_depth | 1 entities | Flame Graph | |
| entity_by_id;two_depth | 10 entities | Flame Graph | |
| entity_by_id;two_depth | 25 entities | Flame Graph | |
| entity_by_id;two_depth | 5 entities | Flame Graph | |
| entity_by_id;two_depth | 50 entities | Flame Graph | |
| entity_by_id;zero_depth | 1 entities | Flame Graph | |
| entity_by_id;zero_depth | 10 entities | Flame Graph | |
| entity_by_id;zero_depth | 25 entities | Flame Graph | |
| entity_by_id;zero_depth | 5 entities | Flame Graph | |
| entity_by_id;zero_depth | 50 entities | Flame Graph |
read_scaling_linkless
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id | 1 entities | Flame Graph | |
| entity_by_id | 10 entities | Flame Graph | |
| entity_by_id | 100 entities | Flame Graph | |
| entity_by_id | 1000 entities | Flame Graph | |
| entity_by_id | 10000 entities | Flame Graph |
representative_read_entity
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1
|
Flame Graph |
representative_read_entity_type
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| get_entity_type_by_id | Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba
|
Flame Graph |
representative_read_multiple_entities
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_property | traversal_paths=0 | 0 | |
| entity_by_property | traversal_paths=255 | 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=0 | 0 | |
| link_by_source_by_property | traversal_paths=255 | 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true |
scenarios
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| full_test | query-limited | Flame Graph | |
| full_test | query-unlimited | Flame Graph | |
| linked_queries | query-limited | Flame Graph | |
| linked_queries | query-unlimited | Flame Graph |
binaryen ships no linux-arm64 release asset (and the aqua registry limits it to darwin/amd64), so the four arm64 Docker images install wasm-opt via the cargo backend again. amd64/darwin environments (CI, Vercel) keep using binaryen's GitHub releases via aqua. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RMbVqCoNeoGCAPRK94LcCF
…rm64 image builds Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RMbVqCoNeoGCAPRK94LcCF
f2f4db0 to
4ee44b3
Compare
…for renamed tools Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RMbVqCoNeoGCAPRK94LcCF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Tim Diekmann · Slack thread
🌟 What is the purpose of this PR?
Before: Vercel builds fail at
./vercel-install.shwithmise ERROR Failed to install tools: cargo:wasm-opt@0.116.1, cargo:wasm-pack@0.15.0. mise re-resolves every config-declared tool's version on eachinstall/use/reshim, and the cargo backend's only version source iscrates.io/api/v1/crates//versions, which rate-limits Vercel's shared egress IPs (429) — roughly 8 mise invocations per build × 7 crates × retries ≈ 170 requests inside 75 seconds, and failed lookups aren't cached.After: the tools that ship exact-version prebuilt GitHub releases for all four supported platforms (linux-x64, linux-arm64, macos-x64, macos-arm64) install via mise's aqua backend instead (checksum-verified, zero crates.io traffic):
aqua:wasm-bindgen/wasm-pack(upstream moved to wasm-bindgen/wasm-pack; same 0.15.0)aqua:taiki-e/cargo-llvm-cov(0.8.7)aqua:nextest-rs/nextest/cargo-nextest(0.9.137; aqua maps this to release tagcargo-nextest-0.9.137)wasm-opt does not change backend anywhere — it stays on
cargo:wasm-opt, like cargo-insta, because binaryen publishes no linux-arm64 prebuilt binaries (the aqua registry marks itsupported_envs: [darwin, amd64]) and wasm-opt runs inside the arm64 Docker image builds. An earlier revision of this PR split wasm-opt across two backends (aqua on amd64/darwin, cargo on arm64); that dual setup has been dropped — the committedmise.lock(from #9000, now enforced on main viamise install --locked) already pins the cargo-backend tools to exact versions and eliminates their crates.io version-listing calls, which was the whole point of the swap.How/notes:
cargo:wasm-opt,cargo:cargo-insta,cargo:cargo-hack, andcargo:cargo-codspeedstay on the cargo backend — wasm-opt and cargo-insta lack linux-arm64 prebuilts and both execute in the arm64 Docker image builds, cargo-hack has no aqua registry entry, and codspeed ships bare linux-musl-only binaries that would break macOS dev machines. With the lockfile enforced, their installs no longer hit the crates.io versions API. Installed binary names are unchanged, so all invocations (wasm-pack build,wasm-opt,cargo insta,cargo llvm-cov,cargo nextest) keep working as-is..config/mise/mise.lockdoes not yet contain entries for the three aqua-backed tools — aqua lock entries need per-platform release URLs and checksums that can only be generated with GitHub network access, which the authoring sandbox does not have. The stalecargo:lock entries for the renamed tools have been pruned; until the aqua entries are added, everymise install --lockedsetup job on this branch fails with… is not in the lockfile. On a machine with GitHub access, run:and commit the resulting
.config/mise/mise.lockto this branch.🔗 Related links
misetool installation against transient upstream failures #9000 — mise.lock groundwork (SRE-805), now merged: main enforcesmise install --locked, so every tool needs a lockfile entry🔍 What does this change?
.config/mise/config.toml: swaps wasm-pack, cargo-llvm-cov, and cargo-nextest from thecargo:backend toaqua:.cargo:wasm-optandcargo:cargo-instastay on the cargo backend (no linux-arm64 prebuilts upstream — see comments in the file). Re-sorted and re-aligned per taploreorder_keys/align_entries;cargo:cargo-hack,cargo:cargo-codspeed, andcargo-binstallare untouched.config/mise/mise.lock: removes the stalecargo:wasm-pack,cargo:cargo-llvm-cov, andcargo:cargo-nextestentries (those tool IDs no longer exist in the config). The replacementaqua:entries still need to be generated — see Remaining step aboveapps/hash-frontend/vercel-install.sh,apps/petrinaut-website/vercel-install.sh: the explicitmise install …tool list now usesaqua:wasm-bindgen/wasm-packand keepscargo:wasm-optapps/{hash-api,hash-ai-worker-ts,hash-frontend,hash-integration-worker}/docker/Dockerfile:mise install …usesaqua:wasm-bindgen/wasm-packand keepscargo:wasm-optlibs/@blockprotocol/type-system/rust/package.json:mise exec … cargo:wasm-pack→aqua:wasm-bindgen/wasm-packin thebuild:wasmscript (tool ID only — the invoked binary is unchanged). Allbuild:typesscripts across the repo keepcargo:cargo-insta.Pre-Merge Checklist 🚀
🚢 Has this modified a publishable library?
This PR:
📜 Does this require a change to the docs?
The changes in this PR:
🕸️ Does this require a change to the Turbo Graph?
The changes in this PR:
.config/miseis a global input), so the first CI run after merge is a cold build.aqua:mitsuhiko/instain an earlier revision of this PR, then reverted to thecargo:backend: it executes inside the arm64 Docker image builds (thebuild:typespackage scripts invoke it viamise execduringturbo build), and its prebuilt releases lack linux-arm64, so the aqua install fails there withunsupported env: linux/arm64. Its exact version is pinned by the committed lockfile.🛡 What tests cover this?
mise lsresolves allaqua:tool IDs; actual installs could not be exercised in the authoring sandbox, so CI on this PR (after the lockfile is regenerated — see Remaining step) is the install verification.❓ How to test this?
mise lockcommand from Remaining step and commit the lockfile — until then all setup jobs fail with… is not in the lockfile../vercel-install.shshould installaqua:wasm-bindgen/wasm-packfrom GitHub releases without touching the crates.io versions API.cargo:wasm-optin theirmise installlayer.Generated by Claude Code