perf: shared apt-base + warmup for dogfood CI

.github/workflows/ci.yml

@@ -112,14 +112,40 @@ jobs:
           sudo /usr/bin/python3 -m pip install --break-system-packages dsls/harmont-py
           /usr/bin/python3 -c "import harmont; print('harmont', harmont.__file__)"
 
+      - name: Restore harmont Docker cache
+        uses: actions/cache/restore@v4
+        with:
+          path: .harmont-cache/
+          key: harmont-v1-will-never-match
+          restore-keys: |
+            harmont-v1-
+
+      - name: Load cached Docker images
+        run: ./target/debug/hm cache restore .harmont-cache/
+
       - name: hm run ci
         env:
           HM_NONINTERACTIVE: '1'
         run: ./target/debug/hm run ci
 
+      - name: Save harmont Docker images
+        id: cache-manifest
+        if: always()
+        run: |
+          hash=$(./target/debug/hm cache save .harmont-cache/)
+          echo "key=harmont-v1-${hash}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload Docker cache
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: .harmont-cache/
+          key: ${{ steps.cache-manifest.outputs.key }}
+
   integration:
     name: docker-gated integration test
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     # Skip the heavy job on draft PRs to save runner minutes. Push to
     # main always runs it.
     if: github.event_name == 'push' || (github.event_name == 'pull_request' && !github.event.pull_request.draft)

.github/workflows/examples.yml

@@ -85,7 +85,6 @@ jobs:
           - cpp
           - csharp
           - go
-          - haskell
           - java
           - kotlin
           - nextjs

.harmont/ci.py

@@ -2,18 +2,45 @@
 from __future__ import annotations
 
 import harmont as hm
-from harmont.py.uv import UvProject
-from harmont.rust import RustToolchain
 
 
 @hm.target()
-def rust_project() -> RustToolchain:
-    return hm.rust(path=".")
+def shared_base() -> hm.Step:
+    return hm.apt_base(packages=(
+        "curl",
+        "ca-certificates",
+        "build-essential",
+        "pkg-config",
+        "libssl-dev",
+        "python3",
+        "python3-venv",
+    ))
 
 
 @hm.target()
-def py_project() -> UvProject:
-    return hm.py.uv(path="dsls/harmont-py")
+def rust_project(shared_base: hm.Target[hm.Step]) -> tuple[hm.Step, ...]:
+    project = hm.rust.project(path=".", base=shared_base)
+    return hm.group([
+        project.test(flags=("--lib",)),
+        project.clippy(),
+        project.fmt(),
+    ])
+
+
+@hm.target()
+def py_project(shared_base: hm.Target[hm.Step]) -> tuple[hm.Step, ...]:
+    project = hm.py.uv(path="dsls/harmont-py", base=shared_base)
+    return hm.group([
+        project.lint(),
+        project.fmt(),
+        project.typecheck(paths="harmont"),
+        project.run(
+            "pytest -v"
+            " --deselect tests/test_gradle.py"
+            " --deselect tests/test_haskell.py",
+            label=":python: test",
+        ),
+    ])
 
 
 @hm.pipeline(
@@ -22,28 +49,11 @@ def py_project() -> UvProject:
     default_image="ubuntu:24.04",
     triggers=[
         hm.push(branch="main"),
-        hm.pull_request(branches="main"),
+        hm.pr(branches="main"),
     ],
 )
 def ci(
-    rust_project: hm.Target[RustToolchain],
-    py_project: hm.Target[UvProject],
-) -> tuple[hm.Step, ...]:
-    return (
-        rust_project.build(),
-        rust_project.installed.sh(
-            ". $HOME/.cargo/env && cd . && cargo test --lib",
-            label=":rust: test",
-        ),
-        rust_project.clippy(),
-        rust_project.fmt(),
-        py_project.lint(),
-        py_project.fmt(),
-        py_project.typecheck(paths="harmont"),
-        py_project.run(
-            "pytest -v"
-            " --deselect tests/test_gradle.py"
-            " --deselect tests/test_haskell.py",
-            label=":python: test",
-        ),
-    )
+    rust_project: hm.Target[tuple[hm.Step, ...]],
+    py_project: hm.Target[tuple[hm.Step, ...]],
+) -> list:
+    return [rust_project, py_project]

.harmont/ci.ts

@@ -1,16 +1,33 @@
-import { pipeline, push, pullRequest, type PipelineDefinition } from "harmont";
+import {
+  pipeline,
+  push,
+  pullRequest,
+  aptBase,
+  type PipelineDefinition,
+} from "harmont";
 import { rust, py } from "harmont/toolchains";
 
-const rustProject = rust({ path: "." });
-const pyProject = py.uv({ path: "dsls/harmont-py" });
+const base = aptBase({
+  packages: [
+    "curl",
+    "ca-certificates",
+    "build-essential",
+    "pkg-config",
+    "libssl-dev",
+    "python3",
+    "python3-venv",
+  ],
+});
+
+const rustProject = rust.project({ path: ".", base });
+const pyProject = py.uv({ path: "dsls/harmont-py", base });
 
 const pipelines: PipelineDefinition[] = [
   {
     slug: "ci",
     triggers: [push({ branch: "main" }), pullRequest({ branches: ["main"] })],
     pipeline: pipeline(
-      rustProject.build(),
-      rustProject.install().sh(`. $HOME/.cargo/env && cd . && cargo test --lib`, { label: ":rust: test" }),
+      rustProject.test({ flags: ["--lib"] }),
       rustProject.clippy(),
       rustProject.fmt(),
       pyProject.lint(),

crates/hm/src/cli/mod.rs

@@ -7,6 +7,8 @@ pub use dev::{DevCommand, DevDownArgs, DevExecArgs, DevLogsArgs, DevPortOfArgs,
 pub use plugin::PluginCommand;
 pub use run::RunArgs;
 
+use std::path::PathBuf;
+
 use anyhow::Result;
 use clap::{Parser, Subcommand};
 
@@ -58,11 +60,35 @@ pub enum Command {
     #[command(subcommand)]
     Dev(DevCommand),
 
+    /// Manage harmont Docker image cache.
+    #[command(subcommand)]
+    Cache(CacheCommand),
+
     /// Interact with the Harmont cloud API.
     #[command(subcommand)]
     Cloud(hm_plugin_cloud::cli::CloudCommand),
 }
 
+#[derive(Debug, Clone, Subcommand)]
+pub enum CacheCommand {
+    /// Save harmont Docker images to a cache directory.
+    Save(CacheSaveArgs),
+    /// Restore harmont Docker images from a cache directory.
+    Restore(CacheRestoreArgs),
+}
+
+#[derive(Debug, Clone, clap::Args)]
+pub struct CacheSaveArgs {
+    /// Directory to save image tars into.
+    pub dir: PathBuf,
+}
+
+#[derive(Debug, Clone, clap::Args)]
+pub struct CacheRestoreArgs {
+    /// Directory containing cached image tars.
+    pub dir: PathBuf,
+}
+
 /// Dispatch a parsed CLI command to the appropriate handler. Returns an exit code.
 ///
 /// # Errors
@@ -72,6 +98,10 @@ pub async fn dispatch(command: Command, ctx: RunContext) -> Result<i32> {
     match command {
         Command::Run(args) => crate::commands::run::handle(args, ctx).await,
         Command::Dev(cmd) => dev::dispatch(cmd, ctx).await,
+        Command::Cache(cmd) => match cmd {
+            CacheCommand::Save(args) => crate::commands::cache::handle_save(&args.dir).await,
+            CacheCommand::Restore(args) => crate::commands::cache::handle_restore(&args.dir).await,
+        },
         Command::Version => version::run().await.map(|()| 0),
         Command::Plugin(cmd) => plugin::run(cmd).await.map(|()| 0),
         Command::Cloud(cmd) => {

crates/hm/src/commands/cache/manifest.rs

@@ -0,0 +1,108 @@
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Manifest {
+    pub version: u32,
+    pub images: BTreeMap<String, String>,
+}
+
+impl Manifest {
+    #[must_use]
+    pub const fn new() -> Self {
+        Self {
+            version: 1,
+            images: BTreeMap::new(),
+        }
+    }
+
+    /// SHA-256 content hash of the JSON-serialized manifest, truncated to 16
+    /// hex characters.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the manifest cannot be serialized to JSON (should never
+    /// happen for this type).
+    #[must_use]
+    #[allow(clippy::expect_used)]
+    pub fn content_hash(&self) -> String {
+        let json = serde_json::to_string(self).expect("manifest serialization cannot fail");
+        let hash = Sha256::digest(json.as_bytes());
+        hex::encode(&hash[..8])
+    }
+}
+
+/// Convert a Docker image tag to the corresponding tar filename.
+///
+/// `"harmont-local/base:a1b2c3d4"` → `"base--a1b2c3d4.tar"`
+#[must_use]
+pub fn tar_name_for_tag(tag: &str) -> String {
+    let stripped = tag.strip_prefix("harmont-local/").unwrap_or(tag);
+    format!("{}.tar", stripped.replace(':', "--"))
+}
+
+/// Inverse of [`tar_name_for_tag`].
+///
+/// `"base--a1b2c3d4.tar"` → `Some("harmont-local/base:a1b2c3d4")`
+#[must_use]
+pub fn tag_from_tar_name(filename: &str) -> Option<String> {
+    let stem = filename.strip_suffix(".tar")?;
+    let (name, hash) = stem.split_once("--")?;
+    Some(format!("harmont-local/{name}:{hash}"))
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, reason = "unit tests")]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tar_filename_from_tag() {
+        assert_eq!(
+            tar_name_for_tag("harmont-local/base:a1b2c3d4"),
+            "base--a1b2c3d4.tar"
+        );
+    }
+
+    #[test]
+    fn tag_from_tar_filename() {
+        assert_eq!(
+            tag_from_tar_name("base--a1b2c3d4.tar"),
+            Some("harmont-local/base:a1b2c3d4".to_string())
+        );
+    }
+
+    #[test]
+    fn tag_from_bad_filename_returns_none() {
+        assert_eq!(tag_from_tar_name("random-file.tar"), None);
+        assert_eq!(tag_from_tar_name("no-extension"), None);
+    }
+
+    #[test]
+    fn manifest_round_trip() {
+        let mut m = Manifest::new();
+        m.images
+            .insert("base".to_string(), "harmont-local/base:abc123".to_string());
+
+        let json = serde_json::to_string(&m).unwrap();
+        let m2: Manifest = serde_json::from_str(&json).unwrap();
+        assert_eq!(m, m2);
+    }
+
+    #[test]
+    fn manifest_content_hash_is_deterministic() {
+        let mut m = Manifest::new();
+        m.images.insert(
+            "step1".to_string(),
+            "harmont-local/step1:deadbeef".to_string(),
+        );
+
+        let h1 = m.content_hash();
+        let h2 = m.content_hash();
+        assert_eq!(h1, h2);
+        assert_eq!(h1.len(), 16);
+        assert!(h1.chars().all(|c| c.is_ascii_hexdigit()));
+    }
+}

crates/hm/src/commands/cache/mod.rs

@@ -0,0 +1,6 @@
+pub mod manifest;
+mod restore;
+mod save;
+
+pub use restore::handle_restore;
+pub use save::handle_save;