Module source_hash 

Shared input-hash ingredients: build platform + source-tree content digest. Used by every action whose inputs include a local tree. Shared input-hash ingredients: build platform and source-tree digest.

Both live here rather than in each action because getting either one wrong produces the same failure — a cache that reports up to date while the artifact is stale — and that failure is silent.

Why the platform belongs in the hash

cargo --version carries no target triple (cargo -vV does), so without platform_tag an aarch64 macOS build and an x86_64 Linux build of the same source hash identically. Harmless with a per-machine SQLite cache; wrong the moment a Neo4j backend is shared, where the second machine reads the first’s entry and installs nothing at all.

RUSTFLAGS is deliberately absent: it is not in the CLI’s ENV_ALLOWLIST, so it never reaches cargo and cannot change the build. RUSTUP_TOOLCHAIN is allowlisted, but is covered transitively — cargo --version runs through the rustup shim and reports the resolved toolchain.

Why the digest is content-only

No mtimes: a fresh CI clone rewrites them all and would make every action look stale forever. Hashing content instead keeps the digest stable across machines, which a shared cache backend requires.

The walk honors .gitignore and always skips .git/ and target/ — hashing build output would be both enormous and self-defeating, since it changes on every build and would trigger a rebuild on every sync.

Functions

platform_tag

Feed the build platform into a hasher.

tree_digest

Content digest of the source tree rooted at path.