fix: download guest artifacts after Rust cache restore (#278)

Download the shared guest bundle after Rust cache restoration in every
consumer job. On partial cache hits, rust-cache cleans target/ and
deletes the previously downloaded bundle manifest, causing valid guests
to fail verification. Keeping downloads after that cleanup preserves
strict verification without rebuilding guests in each job.

The regression failed in CI before the fix. This addresses the cache
failure exposed by #275; it does not change cancellation behavior.

---------

Signed-off-by: James Sturtevant <jsturtevant@gmail.com>

Author: jsturtevant

.github/workflows/ci.yml

@@ -131,10 +131,6 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: guest-bundle
-
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           components: clippy
@@ -146,6 +142,11 @@ jobs:
             target/hyperlight-js-runtime
             target/hls
 
+      # Rust cache cleanup can remove target/guest-build; download the bundle afterward.
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: guest-bundle
+
       - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
 
       - name: Install Python
@@ -199,10 +200,6 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: guest-bundle
-
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: nightly, 1.94
@@ -215,6 +212,10 @@ jobs:
             target/hyperlight-js-runtime
             target/hls
 
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: guest-bundle
+
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68  # v6.0.0
         with:
           dotnet-version: '8.0.x'
@@ -287,10 +288,6 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: guest-bundle
-
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           components: clippy
@@ -302,6 +299,10 @@ jobs:
             target/hyperlight-js-runtime
             target/hls
 
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: guest-bundle
+
       - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
 
       - name: Install Python
@@ -375,10 +376,6 @@ jobs:
       HYPERLIGHT_GUEST_ARTIFACT: "1"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: guest-bundle
-
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           cache-key: release-${{ hashFiles('src/wasm_sandbox/wit/**/*.wit') }}
@@ -389,6 +386,10 @@ jobs:
             target/hyperlight-js-runtime
             target/hls
 
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: guest-bundle
+
       - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
 
       - name: Install Python
@@ -437,10 +438,6 @@ jobs:
       HYPERLIGHT_GUEST_ARTIFACT: "1"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: guest-bundle
-
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           cache-key: release-${{ hashFiles('src/wasm_sandbox/wit/**/*.wit') }}
@@ -451,6 +448,10 @@ jobs:
             target/hyperlight-js-runtime
             target/hls
 
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: guest-bundle
+
       - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
 
       - name: Install Python
@@ -549,10 +550,6 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: guest-bundle
-
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           components: clippy
@@ -564,6 +561,10 @@ jobs:
             target/hyperlight-js-runtime
             target/hls
 
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: guest-bundle
+
       - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
 
       - name: Install just

scripts/tests/test_ci_guest_artifacts.py

@@ -0,0 +1,25 @@
+"""Keep shared guest artifacts out of Rust cache restore cleanup."""
+
+import re
+import unittest
+from pathlib import Path
+
+
+class GuestArtifactWorkflowTests(unittest.TestCase):
+    def test_guest_download_follows_rust_cache_restore(self):
+        workflow = Path(__file__).resolve().parents[2] / ".github" / "workflows" / "ci.yml"
+        jobs = re.split(r"(?m)^  ([\w-]+):\s*$", workflow.read_text(encoding="utf-8").split("jobs:\n", 1)[1])
+        consumers = 0
+        for name, job in zip(jobs[1::2], jobs[2::2], strict=True):
+            if 'HYPERLIGHT_GUEST_ARTIFACT: "1"' not in job:
+                continue
+            consumers += 1
+            with self.subTest(job=name):
+                restore = job.index("- uses: actions-rust-lang/setup-rust-toolchain@")
+                download = job.index("- uses: actions/download-artifact@")
+                self.assertGreater(download, restore, "Rust cache restore can delete the downloaded guest manifest")
+        self.assertGreater(consumers, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()