gate: opt-in sccache for the workspace's own crates

rust-cache keeps dependencies but not the workspace's crates, so every
gate run compiles all of them again. With `sccache: true` the gate wraps
rustc in sccache over the GitHub Actions cache. It writes where the
dependency cache saves (the default branch, opted-in dispatches) and
only reads elsewhere; SCCACHE_GHA_RW_MODE in `env` overrides that.

Off by default, so no caller changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/gate.yml

@@ -78,6 +78,11 @@ on:
         type: boolean
         required: false
         default: true
+      sccache:
+        description: "Also cache the workspace crates' compiled libraries (which rust-cache leaves out) with sccache in the GitHub Actions cache. It writes where the dependency cache is saved (pushes to the default branch, opted-in manual runs); other runs read those entries. SCCACHE_GHA_RW_MODE in `env` overrides that. Test executables are never cached"
+        type: boolean
+        required: false
+        default: false
       cache-version:
         description: "Bump to start the dependency cache afresh"
         type: string
@@ -266,6 +271,25 @@ jobs:
           save-if: ${{ github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || (inputs.cache-save-on-dispatch && github.event_name == 'workflow_dispatch')) }}
           cache-on-failure: true
 
+      # After rust-cache, so its key does not depend on RUSTC_WRAPPER.
+      - name: Install sccache
+        if: inputs.sccache
+        uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: v0.18.0
+
+      - name: Use sccache
+        if: inputs.sccache
+        shell: bash
+        env:
+          WRITES: ${{ github.event_name != 'pull_request' && (github.ref_name == github.event.repository.default_branch || (inputs.cache-save-on-dispatch && github.event_name == 'workflow_dispatch')) }}
+        run: |
+          echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
+          echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+          if [ -z "${SCCACHE_GHA_RW_MODE:-}" ] && [ "$WRITES" != true ]; then
+            echo "SCCACHE_GHA_RW_MODE=READ_ONLY" >> "$GITHUB_ENV"
+          fi
+
       - name: Gate
         shell: bash
         env:

README.md

@@ -492,7 +492,11 @@ The quality gate for an app's pull requests and pushes to main. It runs `command
   `cache-save-on-dispatch: true`. The restore prefix includes the canonical root `[profile]`
   table; dependency, version and comment edits do not discard reusable dependency artifacts.
   rust-cache still keys on lockfiles, member manifests, toolchain and build environment, and
-  Cargo validates restored fingerprints. Bump `cache-version` to start afresh.
+  Cargo validates restored fingerprints. Bump `cache-version` to start afresh;
+- with `sccache: true`, sccache (through the GitHub Actions cache) for the workspace's own
+  library crates, which rust-cache doesn't keep. It writes where the dependency cache saves and
+  only reads elsewhere; set `SCCACHE_GHA_RW_MODE` in `env` to choose. Test, binary and
+  proc-macro crates aren't cacheable, so it mainly helps workspaces with many library crates.
 
 After the gate, the job fails if `Cargo.lock` changed. Legs run with `fail-fast: false`; each has
 `timeout-minutes` (default 60). A job only some apps need, such as a web build or a Windows-only
@@ -866,7 +870,8 @@ with the rustup `llvm-profdata` and `llvm-cov` tools. Pass `shards: 1` to keep
 the single `cargo llvm-cov` job. Sharded runs skip doctests, because nextest
 does not run them.
 
-The scan job frees unused runner SDKs before either Rust coverage path. Sharded
+The scan job frees unused runner SDKs before either Rust coverage path. The archive build
+frees them in the background, so the build starts at once. Sharded
 coverage merges and removes raw profiles before extracting the test archive, then
 releases the compressed archive and temporary binaries as they are consumed.
 Disk-space snapshots in the logs show headroom before cleanup and aggregation.