[Copilot]

Summary

Rust-only rebuilds rerun the Rust build script in a fresh Bazel action sandbox. Keeping a private gzip cache under that action's OUT_DIR did not let the shipping build reuse compressed output across those actions.

Gzip preparation now runs inside the existing cached dashboard app_dist producer. The Rust build script validates, stages, and embeds those prepared bytes.

Changes

• Rsbuild prepares deterministic gzip payloads once per dashboard asset-production action. It adds an original-path-to-gzip-path map and the payload inventory to the existing asset-manifest.json.
• The Rust consumer validates the inventory, normalized mapping, payload sizes, and round-trip bytes. It copies the advertised bundle and embeds original route names with the selected encoding.
• The bundle digest covers both payload bytes and the canonical encoding map. Empty or absent gzip maps preserve the shipped identity-only digest contract. Mapping-only tampering is refused when reopening a staged bundle.
• The private Rust OUT_DIR gzip cache and Rust compression producer are removed. There is one asset manifest and one bundle identity.
• Preparation handles repeated invocation, existing gzip identity files, output-name collisions, and corrupt mappings. The HTTP identity response decodes every gzip member, matching producer and manifest validation.

Validation

Passed locally:

• Five focused Vitest producer tests.
• Full dashboard TypeScript --noEmit.
• A real Rsbuild production build: 66 original routes, 56 prepared gzip payloads, and 122 inventory files.
• The expanded Python bundle-checker gate, including a reproduced-and-fixed mapping-digest regression, canonical mapping/path ordering, identity-only compatibility, and corrupt payload/mapping refusal.
• Pinned repository rustfmt and git diff --check.

Added native regressions for staging the same prepared bundle into independent fresh build stores, original-route embedding, corrupt/unlisted mappings, mapping-only digest tampering, and a real HTTP identity request for a concatenated gzip stream. Native compilation and execution are delegated to CI; they have not passed locally.

Remaining issue acceptance

Refs #4342. The requested measurements on the shipping Bazel cold/warm path—compression calls, bytes written, CPU, and wall time—remain outstanding. This change puts gzip in the cached asset-production action, but does not claim a measured build-time improvement.

The PR is ready for review so the repository's full native CI can run.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 09e8c88

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

Cross-referenced #4342. The prepared-set validation is scoped by digest, but the new cache does not cross the shipping Bazel action boundary; it therefore does not establish the warm Rust-only rebuild benefit claimed in the summary. Details are inline.

I changed the PR body's Fixes #4342 to Refs #4342 so this partial implementation cannot automatically close the issue. The Bazel asset-action integration and the issue's warm-rerun measurements remain open. No performance measurement is claimed by this review.

[ScriptedAlchemy]

Pushed 23eb4996961a5e0afa6cd47e2ebf277cba157db9 to fix the shipping build path, and marked the PR ready so native CI is selected.

The old private OUT_DIR cache was discarded with each Bazel build-script action. Gzip preparation now belongs to the cached Rsbuild/app_dist action. The existing asset manifest owns the gzip mapping and complete inventory; the Rust consumer validates and embeds prepared bytes, and its private compressor/cache is removed.

Final review also caught and fixed two integrity edges: the bundle digest now includes the normalized encoding map, and the HTTP identity response decodes all gzip members consistently with preparation/validation. New native regressions cover fresh independent stores, original routes, tampered mappings, corrupt payloads, and the actual HTTP response.

Passed locally: 5 producer Vitest cases, full dashboard TypeScript, a real production build (66 original routes + 56 gzip payloads), expanded Python bundle-checker cases, pinned rustfmt, and diff checks. The mapping-digest regression failed before the correction and passes now. Native compilation/tests are still pending CI.

The description now reflects the implementation. #4342 stays referenced: shipping-path CPU/wall-time, compression-call, and bytes-written measurements remain outstanding.

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)