ci: slightly faster rust checks (#5048)

## Describe your changes

A bit of spring cleaning for the CI suite. These changes aim at faster
run times on PRs, mostly via reusing common tooling, and reducing setup
time. These changes _don't_ affect which tests run, out of an abundance
of caution, because we have ongoing development in a feature branch
right now (#5010).

The longest-running CI check is currently the check-all-features job,
which clocks in at ~14m with these changes. That's an improvement over
the ~20m or so it's been taking on other PRs. For full details on the
changes, see the commit messages; to summarize:

* smoke tests use the existing tooling env
* most checks can now be run locally via a justfile target, e.g. `just
check`, to make CI failures more easily replicable locally
* test names have been reformatted for readability
* the noisy "release" checks are removed from PR runs

Overall the checks seem to complete >5m faster than before, which is
good enough to merge as progress. I'm deferring more substantive changes
like kicking long-running jobs to schedules, rather than on-every-PR,
until we have a chance to observe these improvements over time, and
until after the LQT push.

### Example of CI job display _before_ changes


![pz-gh-ci-before](https://github.com/user-attachments/assets/253f991c-c2c8-400b-9e6e-0e5836c0a373)

### Example of CI job display _after_ changes


![pz-gh-ci-after](https://github.com/user-attachments/assets/66fa4c61-4f24-4a6b-afb5-0e0ee9bee348)


## Issue ticket number and link

N/A 

## Checklist before requesting a review

- [x] If this code contains consensus-breaking changes, I have added the
"consensus-breaking" label. Otherwise, I declare my belief that there
are not consensus-breaking changes, for the following reason:

  > ci and test code only, application logic remains unchanged

.github/workflows/buf-pull-request.yml

@@ -1,4 +1,4 @@
-name: Protobuf
+name: protobuf
 on:
   # Exclude feature branches, only run if the PR is targeting main.
   pull_request:
@@ -7,8 +7,7 @@ on:
 jobs:
   # Ensure there are no breaking changes to the protocol specs,
   # by running the "buf lint" action against the changes in this PR.
-  lint:
-    name: Lint protobuf
+  backwards-compatibility:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -41,12 +40,13 @@ jobs:
         with:
           input: "proto"
           # The 'main' branch of the GitHub repository that defines the module.
-          against: "https://github.com/${GITHUB_REPOSITORY}.git#branch=main,subdir=proto"
+          # Don't use `GITHUB_REPOSITORY`, because then it'll fail when run on forks.
+          # against: "https://github.com/${GITHUB_REPOSITORY}.git#branch=main,subdir=proto"
+          against: "https://github.com/penumbra-zone/penumbra.git#branch=main,subdir=proto"
 
   # Run our bespoke tooling for codegen, consuming the protocol buffer definitions
   # and emitting generated code. Afterward, there should be no uncommitted changes.
-  protobuf-fresh:
-    name: Compile protobuf specs to rust code
+  build:
     runs-on: buildjet-16vcpu-ubuntu-2204
     steps:
       - name: Checkout the source code

.github/workflows/buf-push.yml

@@ -1,4 +1,4 @@
-name: Update protobuf docs
+name: protobuf
 # We want to rebuild on every commit to main, and also for named testnet tags,
 # so that API users can pick a tagged version of the protobuf definitions
 # to use against a matching testnet.
@@ -9,7 +9,7 @@ on:
     tags:
       - '**'
 jobs:
-  build:
+  publish:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -18,6 +18,7 @@ jobs:
           buf_api_token: ${{ secrets.BUF_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
           input: 'proto'
+
       - uses: bufbuild/buf-lint-action@v1
         with:
           input: 'proto'

.github/workflows/containers.yml

@@ -1,5 +1,5 @@
 ---
-name: Create and publish container images
+name: containers
 on:
   # Build on merge to main, or any tag push.
   push:

.github/workflows/docs-lint.yml

@@ -1,12 +1,11 @@
-name: Docs lint
+name: docs-lint
 on: pull_request
 
 jobs:
   rustdocs:
     # We use a custom script to generate the index page for https://rustdoc.penumbra.zone,
     # and refactors to rust deps can break that generation. Let's ensure this script exits 0
     # on PRs, but we'll still only deploy after merge into main.
-    name: rustdoc-lint
     runs-on: buildjet-8vcpu-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
@@ -21,14 +20,16 @@ jobs:
       - name: Load rust cache
         uses: astriaorg/buildjet-rust-cache@v2.5.1
 
+      # Don't bother importing nix env, since we only need cargo-nightly,
+      # no other deps.
+
       # Building with warm cache takes ~40s, depending on changes.
       - name: Build rustdocs
         run: ./deployments/scripts/rust-docs
 
   # Also validate that the `mdbook` docs (guide & protocol) build correctly.
   # In particular, links are checked within the docs.
   mdbook:
-    name: mdbook-lint
     # Downgrading runner size to 4vcpu, since we're not compiling code.
     runs-on: buildjet-4vcpu-ubuntu-2204
     steps:
@@ -39,8 +40,9 @@ jobs:
       - name: Load rust cache
         uses: astriaorg/buildjet-rust-cache@v2.5.1
 
-      # It's OK to install from crates, building from source, because of cache use
-      # on previous step. Install takes ~5s with warm cache.
+      # Don't bother importing nix env, since we only need a few cargo deps.
+      # It's OK to install from crates, building from source, because the
+      # rust-cache restore on the previous step reduces the install step to ~5s.
       - name: Install mdbook dependencies
         run: cargo install mdbook mdbook-katex mdbook-mermaid mdbook-linkcheck
 

.github/workflows/notes.yml

@@ -1,4 +1,4 @@
-name: Render and Deploy Docs
+name: docs
 
 on:
   workflow_dispatch:
@@ -8,8 +8,10 @@ on:
 
 jobs:
 
+  # Renders and deploys protocol and API docs.
+  # Would be faster if we parallelized it, but it's already <10m,
+  # and only runs post-merge on main, so 10m isn't bad.
   build:
-    name: Render and deploy protocol and API docs
     timeout-minutes: 30
     runs-on: buildjet-16vcpu-ubuntu-2204
     steps:

.github/workflows/release.yml

@@ -41,7 +41,6 @@ on:
   push:
     tags:
       - '**[0-9]+.[0-9]+.[0-9]+*'
-  pull_request:
 
 jobs:
   # Run 'cargo dist plan' (or host) to determine what tasks we need to do

.github/workflows/rust.yml

@@ -1,37 +1,45 @@
-name: Rust CI
+name: rust
 on:
   pull_request:
     # Don't run Rust tests if only docs changed.
     paths-ignore:
       - 'docs/**'
+  # Also support ad-hoc calls for workflow.
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  test:
-    name: Test Suite
+  lint:
     runs-on: buildjet-16vcpu-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
         with:
           lfs: true
 
-      # The `rust-toolchain.toml` file dictates which version of rust to setup.
-      - name: check rust version
-        run: rustc --version
+      - name: install nix
+        uses: nixbuild/nix-quick-install-action@v28
 
-      - name: Install nextest
-        uses: taiki-e/install-action@nextest
+      - name: setup nix cache
+        uses: nix-community/cache-nix-action@v5
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          backend: buildjet
 
       - name: Load rust cache
         uses: astriaorg/buildjet-rust-cache@v2.5.1
 
-      - name: Run cargo check, failing on warnings
-        run: cargo check --release --all-targets
-        env:
-          # The `-D warnings` option causes an error on warnings.
-          RUSTFLAGS: "-D warnings"
+      # The `rust-toolchain.toml` file dictates which version of rust to setup.
+      - name: check rust version
+        run: nix develop --command rustc --version
 
-      - name: Check wasm compatibility
-        run: ./deployments/scripts/check-wasm-compat.sh
+      # Run `cargo check`, with a custom target dir for caching.
+      - name: run cargo check
+        run: nix develop --command just check
 
       # If a dependency was modified, Cargo.lock may flap if not committed.
       - name: Check for diffs
@@ -47,42 +55,37 @@ jobs:
               echo "OK: no uncommitted changes detected"
           fi
 
-      - name: Run tests with nextest
-        run: cargo nextest run --release
-        env:
-          CARGO_TERM_COLOR: always
-
-  fmt:
-    name: Rustfmt
-    runs-on: buildjet-8vcpu-ubuntu-2204
+  # As of 2025Q1, the "features" job is the slowest in the CI suite.
+  # Consider moving to a scheduled job on main, rather than running on PRs.
+  features:
+    runs-on: buildjet-16vcpu-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
         with:
-          # we don't need lfs for the check to pass, but we do need it for the paths-ignore
-          # option to work correctly.
           lfs: true
-      - name: Load rust cache
-        uses: astriaorg/buildjet-rust-cache@v2.5.1
-      - run: cargo fmt --all -- --check
 
-  check:
-    name: Check all crate features
-    runs-on: buildjet-16vcpu-ubuntu-2204
-    steps:
-      - uses: actions/checkout@v4
+      - name: install nix
+        uses: nixbuild/nix-quick-install-action@v28
+
+      - name: setup nix cache
+        uses: nix-community/cache-nix-action@v5
         with:
-          lfs: true
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          backend: buildjet
+
       - name: Load rust cache
         uses: astriaorg/buildjet-rust-cache@v2.5.1
-      - name: install cargo-hack
-        run: cargo install cargo-hack
+
       # Build each crate separately, to validate that the feature-gating is working.
       # This is a lighter-weight version of `cargo check-all-features --workspace --release`.
-      - run: ./deployments/scripts/check-crate-feature-sets
+      - name: check crate features
+        run: nix develop --command ./deployments/scripts/check-crate-feature-sets
+
+      - name: check wasm compatibility
+        run: nix develop --command ./deployments/scripts/check-wasm-compat.sh
 
-  # Integration tests that run against the public testnet endpoints.
-  # Temporarily enabling these in CI, to provide assurance during refactoring.
-  testnet-integration:
+  test:
     runs-on: buildjet-16vcpu-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
@@ -102,9 +105,7 @@ jobs:
       - name: Load rust cache
         uses: astriaorg/buildjet-rust-cache@v2.5.1
 
-      # Confirm that the nix devshell is buildable and runs at all.
-      - name: validate nix env
-        run: nix develop --command echo hello
-
-      - name: run the testnet integration tests
-        run: nix develop --command just integration-testnet
+      - name: Run tests with nextest
+        run: nix develop --command just test
+        env:
+          CARGO_TERM_COLOR: always

.github/workflows/smoke.yml

@@ -1,47 +1,49 @@
-name: Smoke Test
+name: integration
 on:
   pull_request:
     # Don't run Rust tests if only docs changed.
     paths-ignore:
       - 'docs/**'
+  # Also support ad-hoc calls for workflow.
+  workflow_call:
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  smoke_test:
+  smoke:
     runs-on: buildjet-16vcpu-ubuntu-2204
-    environment: smoke-test
     steps:
       - uses: actions/checkout@v4
         with:
           lfs: true
 
-      - name: Load rust cache
-        uses: astriaorg/buildjet-rust-cache@v2.5.1
-
-      - name: Install cometbft binary
-        run: ./deployments/scripts/install-cometbft
+      - name: install nix
+        uses: nixbuild/nix-quick-install-action@v28
 
-      - name: Install process-compose
-        run: >-
-          sh -c "$(curl --location https://raw.githubusercontent.com/F1bonacc1/process-compose/main/scripts/get-pc.sh)" --
-          -d -b ~/bin
+      - name: setup nix cache
+        uses: nix-community/cache-nix-action@v5
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          backend: buildjet
 
-      - name: Install grpcurl
-        run: ./deployments/scripts/install-grpcurl
+      - name: Load rust cache
+        uses: astriaorg/buildjet-rust-cache@v2.5.1
+        with:
+          # bust cache with unique key; increment the integer in `^v(\d+)` to force fresh cache
+          prefix-key: "v0-rust-smoke"
 
-      - name: Run the smoke test suite
-        run: |
-          export PATH="$HOME/bin:$PATH"
-          ./deployments/scripts/smoke-test.sh
+      - name: run the smoke-test suite
+        run: nix develop --command just smoke
 
       - name: Display smoke-test logs
         if: always()
         run: cat deployments/logs/smoke-*.log
 
-  pmonitor-integration:
+  pmonitor:
     runs-on: buildjet-16vcpu-ubuntu-2204
     steps:
       - uses: actions/checkout@v4
@@ -61,9 +63,30 @@ jobs:
       - name: Load rust cache
         uses: astriaorg/buildjet-rust-cache@v2.5.1
 
-      # Confirm that the nix devshell is buildable and runs at all.
-      - name: validate nix env
-        run: nix develop --command echo hello
-
       - name: run the pmonitor integration tests
-        run: nix develop --command just test-pmonitor
+        run: nix develop --command just integration-pmonitor
+
+  # Integration tests that run against the public testnet endpoints.
+  # Temporarily enabling these in CI, to provide assurance during refactoring.
+  testnet:
+    runs-on: buildjet-16vcpu-ubuntu-2204
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          lfs: true
+
+      - name: install nix
+        uses: nixbuild/nix-quick-install-action@v28
+
+      - name: setup nix cache
+        uses: nix-community/cache-nix-action@v5
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          backend: buildjet
+
+      - name: Load rust cache
+        uses: astriaorg/buildjet-rust-cache@v2.5.1
+
+      - name: run the testnet integration tests
+        run: nix develop --command just integration-testnet

.gitignore

@@ -53,6 +53,7 @@ deployments/relayer/configs/penumbra-local.json
 # Logs, and other files from smoke tests
 deployments/logs/
 crates/bin/pcli/proposal.toml
+crates/bin/pcli/spend_proof.txt
 phase1.bin
 
 # Memory profiler, via bytehound or otherwise