ci: seed mbx cache for fork PRs

[jdx]

Summary

• restore the fork-facing GitHub Actions mbx cache in one canonical CI job per supported OS
• keep the trusted server backend active for compilation, then save the updated local store under the exact key format fork PRs restore
• restrict mirror writes to jdx pushes on main; fork and other untrusted PR runs remain restore-only and OIDC-free

Validation

• actionlint
• high-severity zizmor audit
• git diff check
• confirmed release workflows do not enable the mirror

---

Note

Low Risk
CI-only cache wiring with mirror writes gated to jdx pushes on main; fork/untrusted runs stay on the existing restore-only GitHub path.

Overview
Adds an optional mirror-github-cache input to the mbx composite action. When enabled on jdx pushes to main, it runs an extra mr-boxington step with the GitHub backend first so trusted CI can warm the same restore-only cache keys fork PRs use, while the existing step still picks server vs GitHub via backend: auto.

The reusable test-impl workflow turns mirroring on for the canonical test (Linux) and test-windows jobs so each supported OS seeds the fork-facing cache during normal main-branch CI. Other callers (e.g. msrv) keep the default and do not mirror.

^{Reviewed by Cursor Bugbot for commit a690177. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features
  • Added an option to mirror trusted pushes to the main branch into GitHub’s cache.
  • Enabled cache mirroring for Linux and Windows test workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 78977a9d-bc25-4ca4-886a-53f58d30acd8

📥 Commits

Reviewing files that changed from the base of the PR and between ae8c656 and a690177.

📒 Files selected for processing (2)

• .github/actions/mbx/action.yml
• .github/workflows/test-impl.yml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The mbx action adds conditional GitHub cache mirroring for trusted pushes to main. The Linux and Windows test jobs enable the new input.

Changes

GitHub cache mirroring

Layer / File(s)	Summary
Conditional cache-mirroring action .github/actions/mbx/action.yml	The action adds the disabled-by-default mirror-github-cache input. It mirrors trusted jdx pushes to refs/heads/main through version 0.4.0 with the GitHub backend.
Test-job enablement .github/workflows/test-impl.yml	The Linux and Windows test jobs enable mirror-github-cache for the local mbx action.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to a6901

This localized CI-only change seeds fork-facing caches while keeping untrusted runs restore-only and OIDC-free; no actionable merge-blocking risk remains beyond normal checks and review.

Poem

A rabbit toggles cache in the night

Main-branch pushes hop into flight
Linux and Windows follow the trail
Trusted mirrors carry the cache tale
The mbx burrow stays neat and bright

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: CI support to seed the mbx cache for fork pull requests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}