ci: route mbx caching by runner provider

[jdx]

Route mbx storage according to the runner provider.

• Namespace jobs keep the local backend on the shared Namespace cache volume.
• GitHub-hosted Linux, macOS, and Windows jobs use the Azure-backed cache at https://cache.jdx.dev with GitHub OIDC.
• GitHub-hosted fork jobs use public, namespace-scoped read access when GitHub withholds OIDC; they receive no cache credential and cannot write.
• Authenticated pull requests and tags are also read-only; only protected main pushes may publish.
• No mbx cache tarballs are mirrored through GitHub Actions Cache.

Validation: actionlint; git diff --check

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.

---

Note

Medium Risk
Changes CI cache authentication and removes GitHub Actions cache mirroring; misconfigured OIDC or env could slow builds or affect fork vs trusted cache access, but scope is limited to CI tooling.

Overview
Replaces the mr-boxington-action + GitHub Actions cache mirror with a single composite action that installs mr-boxington 1.5.0 via mise and sets MBX_* env for either Namespace local storage or the remote cache at https://cache.jdx.dev.

Trusted Namespace jobs still use backend: local; GitHub-hosted jobs use backend: server (renamed from github). The mirror-github-cache input and main-branch mirror restore step are removed. Server mode wires MBX_REMOTE_URL, namespace, and OIDC audience when ACTIONS_ID_TOKEN_REQUEST_URL is present; otherwise it logs a notice and relies on public read-only access.

Workflow updates: test.yml grants id-token: write on the trusted path; test-impl.yml drops the untrusted OIDC assertion and stops passing mirror-github-cache. The mbx action also adds Windows mise paths under runner.tool_cache so install works on windows-latest.

^{Reviewed by Cursor Bugbot for commit 7f7d88f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: adb44f12-6c08-4ccd-969f-948f6f49e4cc

📥 Commits

Reviewing files that changed from the base of the PR and between cc8d7c5 and 89f4aca.

📒 Files selected for processing (3)

• .github/actions/mbx/action.yml
• .github/workflows/test-impl.yml
• .github/workflows/test.yml

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The mbx action now uses platform-specific mise setup, installs mbx for all backends, and configures server or local-store environment variables. Workflows select the server backend where required and grant OIDC permissions. The mr-boxington dependency was upgraded to 1.5.0.

Changes

mbx store setup

Layer / File(s)	Summary
Unified mbx installation and configuration .github/actions/mbx/action.yml, mise.toml	The action configures mise for each runner platform, installs mbx unconditionally, handles Windows PATH updates, and emits backend environment variables. mr-boxington was upgraded to 1.5.0.
Workflow backend and OIDC alignment .github/workflows/test-impl.yml, .github/workflows/test.yml	Untrusted, Windows, and MSRV runs use the server backend. Trusted runs retain local. Both test jobs receive id-token: write.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to 89f4a

This change routes untrusted CI jobs through a shared remote cache using OIDC. The PR depends on server-side controls to prevent untrusted writes and cross-namespace access, but those controls are not verified here; the change is therefore not fully merge-ready until that authorization behavior is confirmed or explicitly accepted.

Sequence Diagram(s)

sequenceDiagram
  participant WorkflowJob
  participant mbxAction
  participant mise
  participant mbx
  WorkflowJob->>mbxAction: invoke with backend
  mbxAction->>mise: configure runner-specific directories
  mbxAction->>mise: install and reshim mbx
  mise-->>mbxAction: provide installed tool path
  mbxAction->>mbx: emit backend environment variables

Loading

Poem

A rabbit hops as mbx starts,
Mise prepares its platform parts.
The server path appears when allowed,
Local stores remain when OIDC is clouded.
Old mirror inputs leave the track.
Version 1.5.0 leads the pack.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: CI now routes mbx caching based on the runner provider.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e81c1db. Configure here.}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
markdown	▁█	380,412,586 → 380,469,239	+0.01%	63.08 → 63.30ms	+0.34%
startup	▁█	944,259 → 950,968	+0.71%	1.17 → 1.16ms	-0.72%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

Shadow comparison

Parsing mise use -g node@20 against a shadow of mise's committed spec.
Reported, not gated: the shadow grows as the derive learns to express more, so
what to watch is the ratio rather than either column.

framework	stripped binary, bytes
usage	1344728
bpaf	2493216
clap	3101656

framework	instructions, cold parse	vs usage
usage	8530	—
clap	6316282	740x
bpaf	21909185	2568x

                                              min       p01       p10    median
usage-rs: argv -> struct                     1240      1261      1274      1279  ns
clap: build tree + parse -> struct        1866124   1871662   1879039   1887409  ns
bpaf: build parser + parse -> struct      5777436   5777436   5820594   5861342  ns

usage: argv -> struct                            1200 ns      1.20 µs
clap: build tree + parse -> struct            1867031 ns   1867.03 µs
clap: parse -> struct, tree reused              72328 ns     72.33 µs
clap: build tree only                         1095286 ns   1095.29 µs

_{7f7d88ff394d vs cec178fe25db · measured on the runner, not pushed to the history.}