| enable | When "true" (default), install the real soldr binary and run the full setup. When "false", skip the soldr download/verify and write a passthrough stub at the soldr binary path that forwards `soldr <tool> <args>` to `<tool> <args>` (as if `soldr` were omitted from the command line). Internal subcommands soldr-aware code paths query (`version`, `cache`, `status`) return stub JSON so the rest of the action keeps working. The Rust toolchain is still provisioned; cache layers naturally no-op because the build-cache dir stays empty. Useful for A/B testing soldr's effect on a workflow without rewriting it.
| no | true |
| version | Soldr version or tag to install. Defaults to 0.8.21. | no | 0.8.21 |
| repo | Internal override for the Soldr source repository used by integration branches. | no | zackees/soldr |
| ref | Internal override that builds Soldr from a Git ref instead of downloading a release asset. | no | "" |
| token | GitHub token used for authenticated release metadata and asset download requests. | no | ${{ github.token }} |
| cache | Umbrella switch for all caching layers. Default "true" (caches managed normally). Set to "false" to disable every layer in one go: setup-cache (soldr binary + rustup state including `~/.rustup/update-hashes/` for fast `rustup update` no-ops, see setup-soldr#102), build-cache (zccache compilation cache), target-cache (Rust target/ artifacts), and cargo-registry-cache. Also exports `SOLDR_BUILD_CACHE_MODE=off` / `SOLDR_TARGET_CACHE_MODE=off` so soldr skips its zccache wrapping entirely — the daemon won't be invoked and no per-session stats are written. Use this when you want a clean uncached build (CI A/B test, debugging cache-related regressions, etc.). For finer control, leave `cache: true` and flip individual layer inputs.
| no | true |
| cache-dir | Override the runner-local cache/state root used for the installed soldr binary and any managed rustup state rehydrated by this action. | no | "" |
| cache-key-suffix | Optional extra suffix appended to the cache key. | no | "" |
| cache-preset | One-line cache policy umbrella. Fills any cache-affecting input that the consumer leaves unset; explicit fine-grained inputs always win (so setting `target-cache: true` keeps that, even under `cache-preset: minimal`). Valid values:
- "minimal": build-cache=false, target-cache=false,
cargo-registry-cache=false, prebuild-deps=soldr-cook
(cook-only; smallest footprint).
- "foundation": build-cache=true, target-cache=false,
cargo-registry-cache=false, prebuild-deps=soldr-cook
(the current default; no behavior change).
- "full": build-cache=true, target-cache=true,
cargo-registry-cache=true, prebuild-deps=soldr-cook,
build-cache-mode=thin (heavy, opt-in).
Empty default keeps each fine-grained input on its historical default (foundation policy). The resolved preset is surfaced via the `cache-preset-effective` output. (#251)
| no | "" |
| toolchain | Override the exact Rust toolchain channel string. When empty, toolchain-file is used if present, otherwise stable. | no | "" |
| toolchain-file | Toolchain file to read when toolchain is not explicitly set. | no | rust-toolchain.toml |
| trust-mode | Optional value for SOLDR_TRUST_MODE. | no | "" |
| linker | Linker override forwarded as SOLDR_LINKER for `soldr cargo ...` builds (requires soldr 0.7.19+). Empty (the default) opts the workflow into `fast` — mold-if-on-PATH-else-rust-lld on Linux, rust-lld on macOS and Windows — and emits a one-time GitHub Actions warning so the override is visible in CI logs. Soldr's own native default is no injection (smaller artifact cache, slower link); pass `platform-default` (or `default`) to opt out and keep whatever cargo config / rust-toolchain.toml specifies. Other accepted values pass through verbatim to SOLDR_LINKER: `ld`, `mold`, `rust-lld`, `fast`. Unknown values raise an error. When the input is left empty and the workflow has already exported any `CARGO_TARGET_<TRIPLE>_LINKER` or `CARGO_TARGET_<TRIPLE>_RUSTFLAGS` env var (typical for cross-compile setups), setup-soldr defers to the user's values and skips the `fast` default to avoid clobbering them. See issue #108.
| no | "" |
| compile-priority | Compiler/linker child-process priority forwarded as ZCCACHE_COMPILE_PRIORITY (requires zccache 1.4.6+). Setup-soldr defaults to `high` because GitHub Actions runners are dedicated to CI and have no foreground workload to yield to — zccache's own native default is `low` (designed for interactive dev). Accepted values: `normal`, `low`, `idle`, `high`. Set to empty string to opt out and let zccache pick its native default.
| no | high |
| timestamps | Prefix setup-soldr diagnostic and streamed command output with elapsed mm:ss timestamps. | no | true |
| timestamp-format | Format used by the timestamp prefix when `timestamps: true`. Accepted values: `mmss` (default - the historical `MM:SS` prefix, e.g. `00:08 message`) and `seconds` (two-decimal seconds since step start, e.g. `8.04 message`). The `seconds` format is monotonic and lets you subtract two adjacent prefixes to read the cost of an operation directly. Has no effect when `timestamps: false`. (#387 Feature 2)
| no | mmss |
| lockfile | Optional Cargo.lock path used for Rust artifact cache keying. Empty infers Cargo.lock next to target-dir, then workspace Cargo.lock. | no | "" |
| build-cache | Restore and save Soldr/zccache build cache state across workflow runs. Empty (default) resolves to "true" unless `cache-preset` overrides it (e.g. `cache-preset: minimal` resolves it to "false"). Set explicitly ("true"/"false") to override any preset. (#251)
| no | "" |
| build-cache-save-min-compiles | Delta-aware build-cache save gate (issues #230 / #214). When a build cache was restored this run (exact or restore-key fallback) and the session recorded fewer than this many new compiles (zccache misses), setup-soldr skips re-saving the build-cache — the restored entry already holds everything, so re-uploading the (often multi-GiB) payload under a fallback key just duplicates it and dominates the Windows post step. Default "1": skip only when literally nothing new was compiled (the safe floor). Raise it (e.g. "10") to also skip tiny deltas, or set "0" to disable the gate and always save. Never gates a cold seed (no restore) or an unreadable compile count, so a real cache is always seedable. Per-phase save timings (compress vs upload) are logged regardless.
| no | 1 |
| target-cache-save-min-compiles | Delta-aware target-cache save gate (#255). Mirror of `build-cache-save-min-compiles` for the Rust `target/` artifact cache: when the target-cache was restored from a fallback key and the session recorded fewer than this many new compiles, skip the target-cache save — the restored entry already holds everything, so re-saving under a new key just re-uploads a duplicate multi-GiB payload. Default "1": skip only when literally nothing new was compiled. Raise to also skip tiny deltas, or set "0" to disable the gate. Never gates an exact-key hit (those already short-circuit) or a cold seed (no restore). Has no effect when `target-cache` is off (the default).
| no | 1 |
| build-cache-mode | Rust build cache mode. "thin" (the resolved default when `target-cache` is opted in) is the bounded dependency-artifact shape. "once" preserves the legacy full-snapshot-on-miss behavior that restores only the local rust-plan bundle on later hits without resaving the full target tree. "full" opts into normal whole-target restore/save behavior and should be treated as unbounded.
Empty default resolves to "thin" when `target-cache: true` is set (either explicitly or via `cache-preset: full`); otherwise empty resolves to "once" — which is unused when target-cache is off but is still surfaced via the `SETUP_SOLDR_BUILD_CACHE_MODE` env var for downstream tools that read it. (#251)
| no | "" |
| seed-isolated-build-cache | Optional newline- or comma-separated list of isolated SOLDR_CACHE_DIR roots to pre-seed from the build-cache this action restores (issue #240). Use this when a later self-test phase deliberately switches to a fresh SOLDR_CACHE_DIR for daemon isolation (e.g. coverage / integration jobs following zccache#430/#421) — without seeding, that isolated phase discards the warm build-cache and recompiles from scratch every run. setup-soldr copies ONLY the content-addressed zccache artifact store (the same file classes the build-cache save keeps: artifacts and their in-place compiler stdout/stderr replay metadata) into `<root>/cache/zccache` for each listed root. Live daemon state — logs, sockets, pidfiles, lock/temp files, and standalone diagnostics — is never copied, so the isolated daemon keeps its own session. Best-effort: seed failures are logged, never fatal. Default empty (no seeding).
| no | "" |
| zccache-seed-strict | When "true", fail setup if setup-soldr cannot seed soldr's pinned zccache install from the vendored or managed release source. Default "false" keeps the seed best-effort and allows soldr's normal managed fallback path. Enable this in repos where a later zccache `cargo install` fallback is unacceptable.
| no | false |
| target-cache | Deprecated compatibility input. Empty (default) resolves to "false" unless `cache-preset: full` overrides it. Set to "true" to enable Rust target artifact caching; prefer `build-cache-mode` for selecting once/thin/full. (#251 cache-preset)
| no | "" |
| target-cache-mode | Deprecated compatibility input translated into build-cache-mode. "hot" maps to "thin", "full" maps to "full", and "off" disables Rust target artifact caching.
| no | "" |
| target-dir | Cargo target directory used by soldr when constructing the Rust artifact cache plan. | no | target |
| target-cache-profile | Thin-slice pruning policy for the target/ cache. Values:
- thin-v1 (default): legacy slice, keeps .rlib/.rmeta/proc-macro outputs
- thin-v2: aggressive prune (fingerprints + dep-info + final outputs only),
relies on zccache compilation cache to repopulate library bytes
- thin-v3: ownership-aware cache contract. Currently uses the safe
`zccache-all-v1` fallback until Soldr can prove a complete
cook package/artifact closure; its cache keys are separate
from thin-v1 and thin-v2.
thin-v1 remains the default. Use thin-v2 or thin-v3 only with a Soldr release that advertises the matching plan schema. thin-v3 deliberately falls back to zccache-all until complete cook ownership is available.
| no | thin-v1 |
| target-cache-strip-debuginfo | When "true", requests that soldr strip debug-info-bearing artifacts from the target-cache before saving. Forward-compatible: requires soldr#237 to take effect; current soldr releases ignore the flag. Default "" (unset - soldr default applies).
| no | "" |
| target-cache-include-incremental | When "false", requests that soldr exclude target/*/incremental/ directories from the target-cache. Forward-compatible: requires soldr#237 to take effect. Default "" (unset - soldr default applies).
| no | "" |
| target-cache-include-build-script-binaries | When "false", requests that soldr exclude target/*/build/*-{hash}/build-script-build binaries from the target-cache. Forward-compatible: requires soldr#237 to take effect. Default "" (unset - soldr default applies).
| no | "" |
| target-cache-compress | Compression codec used when packing the target-cache tar archive. Values: "auto" (let soldr decide), "zstd" (force zstd), or "none" (uncompressed). Default "zstd". Forward-compatible: requires a soldr release that consumes SOLDR_TARGET_CACHE_COMPRESS; older soldr releases ignore the setting and fall back to their built-in behavior.
| no | zstd |
| target-cache-compress-level | Compression level used when target-cache-compress is "zstd" (or "auto" and soldr selects zstd). Accepts integers 1-22; zstd's default is 3. Forward-compatible: requires a soldr release that consumes SOLDR_TARGET_CACHE_COMPRESS_LEVEL.
| no | 3 |
| cache-payload-warn-bytes | Soft warning threshold for tar-backed cache saves, measured before compression. Accepts bytes or KiB/MiB/GiB/TiB suffixes. When exceeded, setup-soldr emits a warning with the largest files so oversized payloads such as multi-GiB zccache archives are visible in CI. Default 512MiB.
| no | 512MiB |
| cache-payload-max-bytes | Hard limit for tar-backed cache saves, measured before compression. Default 6GiB matches the realistic zccache footprint for a medium-large Rust workspace (zccache CI itself was running at 4-5 GiB and chronically hitting the previous 2GiB cap → build-cache became enabled-but-inert, see setup-soldr#279). Set to 0 to disable the limit. When exceeded, cache-payload-oversize-action decides whether setup-soldr skips the save or fails the post step. The GitHub Actions Cache service caps individual entries at ~10 GiB and per-repo total at 10 GiB; 6GiB sits comfortably below both.
| no | 6GiB |
| cache-payload-oversize-action | Behavior when cache-payload-max-bytes is exceeded. "skip" logs a warning and does not upload the cache entry. "fail" treats the oversized payload as a cache packaging error. Ignored when cache-payload-max-bytes is empty.
| no | skip |
| cache-encrypt-key | Optional 256-bit AES key used to encrypt every managed cache layer's `.tar.zst` archive with AES-256-GCM before upload, and to verify + decrypt the same archives on restore. Accepts the key as 64-char hex, 44-char base64, or 43-char base64url. Pass via a GitHub Actions secret reference in your workflow (see the "Release-grade usage: encrypted cache" section of the README for a copy-pasteable example). setup-soldr immediately marks the value as a secret so it cannot leak into log output.
Use this on release pipelines to prevent cache poisoning: an attacker who can write to the Actions Cache for this repo (forked PR with cache-write scope, leaked GITHUB_TOKEN, etc.) cannot plant a malicious tarball under one of setup-soldr's cache keys without possessing the AES key — the GCM tag verification will fail and the tampered archive is rejected.
Empty (default) keeps the historical plaintext path; encryption adds a per-archive disk read+write pass (~5 s per GiB on a typical SSD) so it should remain opt-in. Mixed-mode tolerant: a legacy plaintext entry is accepted with a warning when the key is set, and an encrypted entry restored without a key is treated as a cold miss (lets you rotate keys without wiping the cache). See #387 Feature 1.
| no | "" |
| cache-encrypt-on-failure | What to do when an encrypted cache entry fails authentication (wrong `cache-encrypt-key`, tampered ciphertext, or AAD mismatch). `error` (default) raises a hard error in red so the release run stops before consuming the bad cache. `skip` logs the failure and treats the entry as a cold miss, letting the run continue with a fresh build. Has no effect when `cache-encrypt-key` is empty.
| no | error |
| cache-payload-top-n | Number of largest files and directories retained in cache payload stats, stats-json, and the final step summary. Set to 0 to suppress top-entry lists while keeping aggregate bytes/files/skipped counts.
| no | 10 |
| source-mtime-normalize | Opt-in. When "true", rewrite the mtime of tracked Rust build-input files under the GitHub Actions workspace to each file's last-commit timestamp before the target-cache restore runs. This keeps Cargo fingerprints stable across fresh checkouts of the same SHA so restored target caches can be reused as a no-op. Files with no git history are left alone, so real source edits still invalidate fingerprints. Defaults to "false".
| no | false |
| cargo-registry-cache | When "true", setup-soldr manages a separate actions/cache step for ~/.cargo/registry that pre-compresses the directory into a single .tar.zst via the embedded setup-soldr-cache-compress sub-action. The same archive also bundles ~/.cargo/.global-cache (cargo's RFC-3413 GC database — without it every job's cargo-gc sees fresh access times and conservatively keeps everything) and ~/.cargo/git/ (bare mirrors and checkouts for git-source crate deps; missing on cold checkouts and silently skipped in that case). See setup-soldr#102. Also exports SOLDR_SKIP_CARGO_REGISTRY_SAVE=1 so the zccache CLI's built-in cargo-registry save (honored in zccache >=1.4.4) no-ops and the payload is not double-saved. Default "false" keeps setup-soldr's default cache footprint small; opt in explicitly when registry restore timing beats the upload/retention cost for the repository.
Deliberately NOT cached on this layer: ~/.cargo/.package-cache and ~/.cargo/.package-cache-mutate are cargo's "another build is running" mutex files — caching them causes false "another cargo is running" errors on the next job. ~/.cargo/credentials.toml is a secret and must not be persisted. The list is enforced by exclusion: we cache explicit basenames (registry, .global-cache, git) rather than the full $CARGO_HOME so accidentally-staged secrets never enter the archive.
Empty (default) resolves to "false" unless `cache-preset: full` overrides it. (#251 cache-preset)
| no | "" |
| dylint | Enable Dylint mode. Default "false": setup-soldr performs no nightly map request, toolchain restore/install, environment substitution, or Dylint-specific cache preparation. When "true", the action maps the resolved Rust major.minor version to the newest compatible dated nightly and scopes that identity to Soldr's Dylint child processes.
| no | false |
| dylint-foundation-cache | Cache the exact Dylint nightly, required components, tools, and driver. Defaults to "true" inside Dylint mode and is inert when dylint is false.
| no | true |
| dylint-output-cache | Reserve Dylint's isolated plugin/workspace output cache policy. Defaults to "true" inside Dylint mode and is inert when dylint is false.
| no | true |
| dylint-cache | Explicit opt-in cache for Dylint tooling. When "true", setup-soldr restores and saves a cache slot for cargo-dylint, dylint-link, Cargo install metadata, and the compatible Dylint driver directory. This is cache-only: cold runs still execute the workflow's normal install/build steps, while warm runs can skip them by checking the dylint-cache-hit output or SETUP_SOLDR_DYLINT_CACHE_HIT environment variable. Default "false" keeps normal Rust setup unchanged.
| no | false |
| dylint-toolchain | Nightly Rust toolchain used by the Dylint driver, e.g. nightly-2026-03-26. Empty defaults to the action's resolved toolchain. Included in the Dylint cache key.
| no | "" |
| dylint-driver-rev | Git revision or version identity for the compatible Dylint driver source. Included in the Dylint cache key. Use the same revision your driver build script checks out.
| no | "" |
| cargo-dylint-version | cargo-dylint version installed by the workflow. Included in the Dylint cache key. | no | 6.0.1 |
| dylint-link-version | dylint-link version installed by the workflow. Included in the Dylint cache key. | no | 6.0.1 |
| dylint-cache-paths | Optional newline- or comma-separated paths to restore/save for dylint-cache. Relative paths are resolved from the workspace. Empty uses $CARGO_HOME/bin/cargo-dylint*, $CARGO_HOME/bin/dylint-link*, $CARGO_HOME/.crates.toml, $CARGO_HOME/.crates2.json, and $RUNNER_TEMP/dylint-drivers.
| no | "" |
| shims | When "true", setup-soldr writes PATH-shadowing shims for cargo, rustfmt, clippy-driver, rustc, and rustdoc into ${cache-dir}/shims/ and prepends that directory to $PATH. Each shim routes its invocation through the installed soldr binary. Default "false".
| no | false |
| compile-cache-stats | Controls compile-cache (zccache) diagnostic output. "none" suppresses all compile-cache info. "summarize" (default) renders a per-session totals table into $GITHUB_STEP_SUMMARY and emits scalar action outputs (hit rate, hits, misses, etc.). "detailed" adds per-extension and per-tool rollup tables and sets compile-cache-rollups-json. "insights" extends summarize with per-diagnosis <details> blocks rendered from `soldr cache report --json`'s `diagnoses[]` array, emits GitHub annotations (::warning::/::notice::) pinned to the relevant source files, and best-effort uploads a chrome-trace artifact (`setup-soldr-trace-<run_id>.json`) when the installed soldr supports `cache report --chrome-trace`.
| no | summarize |
| verify-compile-cache | Guard against silently-bypassed compile caching. When a job is expected to exercise zccache but the session reports hits + misses == 0, the build was not routed through the cache (bypass) or the measurement is invalid — reporting that as a successful warm cache is misleading. Values: "off" (default, no check), "warn" (emit a GitHub Actions warning with the likely bypass cause), "error"/"true" (fail the post step). Legitimate bypasses are always skipped, never failed: enable:false passthrough, build-cache:false, an unreadable compile-cache report, or unavailable hit/miss counters. The diagnostic names RUSTC_WRAPPER, SOLDR_CACHE_DIR, ZCCACHE_CACHE_DIR, the shims dir, and the session stats path so the bypass is actionable. Sets the compile-cache-verification output to ok / invalid-measurement / skipped.
| no | off |
| stats | Controls diagnostic output for cache operations. "none" suppresses all stats output. "summarize" (default) prints a compact hit/miss table after setup. "detailed" adds full JSON stats to the log, writes $RUNNER_TEMP/setup-soldr-stats.json and $RUNNER_TEMP/setup-soldr-session.log (updated by the post phase with save operations), and sets the stats-json output.
| no | summarize |
| debug | When "true", enables verbose per-operation diagnostics: archive magic bytes, compressed/inflated byte counts, file counts, compression ratios, and the exact decompression/compression commands run.
| no | false |
| journal-print-raw | When "true", the post-phase diagnostic dump appends the verbatim per-rustc-invocation JSONL stream from `${ZCCACHE_CACHE_DIR}/logs/last-session.jsonl` to stdout. Default is empty, which mirrors `debug` (so users who set `debug: true` keep the pre-existing forensic dump). Set to "false" to suppress the raw stream even when debug is on — useful for workflows that already upload the JSONL as an artifact and don't want to pay the log-writer cost (the raw stream is often thousands of records / 20-30 MB and can add 30-50 s to the post step on hosted runners). Accepts "true"/"false"/"on"/"off"/"yes"/"no"/"1"/"0".
| no | "" |
| rust-backtrace | Value to export as `RUST_BACKTRACE`. Default "1" so any unexpected panic in `soldr cargo …` (or anything else downstream of this action) emits a backtrace immediately — saving a re-run to capture context after the fact. Accepts "1"/"true"/"on"/"yes" (trimmed backtrace, default), "full" (full stack including std internals), or "0"/"false"/"off"/"no"/"" to skip the export and keep whatever the calling environment had. Has no effect on release builds with `panic = "abort"` (Rust doesn't print a backtrace in that case) and only fires on panic — there's no runtime cost for builds that don't panic.
| no | 1 |
| cache-shutdown-on-idle | Configure the cache daemon (zccache / sccache) to self-exit after this much idle time. Accepts bare integers (seconds), "<N>s", "<N>m", or "<N>h". The empty string and "0"/"off"/"false" disable the override and let the daemon use its built-in timeout. When set, setup-soldr exports both `ZCCACHE_IDLE_TIMEOUT` and `SCCACHE_IDLE_TIMEOUT` to the resolved seconds so the daemon dies between idle compile invocations and respawns on next use — a workaround for daemons that accumulate state or hold locks across a long build. The post step always calls `soldr cache shutdown` (falling back to `zccache stop` when needed) as a final best-effort sweep regardless of this setting.
| no | "" |
| logging | When "true", emit a one-shot "DIAGNOSTIC DUMP" section after the main step (post-resolve) and again at the end of the post step. The dump includes every observed `INPUT_*` env var (so you can see what the runner actually passed in), the parsed RawInputs struct, every constructed cache key with its restore-key fallbacks, all restore/save outcomes, key SOLDR_/ZCCACHE_ env exports, and the compile-cache report. Token-shaped values are redacted. Use this when cache behavior surprises you — captures everything needed to file a bug without having to re-run with extra flags. Distinct from `debug`, which only adds a few targeted `[debug]` lines.
| no | false |
| preserve-source-mtimes | Experimental. When "true", snapshot every tracked Rust source file's (mtime, size, content-hash) at cold-post time and replay the mtime onto matching files on warm — *only* when the current content is byte-identical to the snapshot. Solves the case where `actions/checkout` resets every source mtime on each run, which otherwise makes Cargo invalidate every fingerprint and bypass zccache's compile cache. The size+hash safety net means we cannot underbuild the way the abandoned `source-mtime-normalize` could: if a source file genuinely changed between cold and warm (e.g., a patch landed at the same SHA range), its current mtime is left alone and Cargo rebuilds correctly. Snapshot is a small JSON sidecar shipped inside the existing build-cache tar.zst.
| no | false |
| solo-toolchain-cache | Maintain a long-lived, small, per-platform cache that holds only what setup-soldr added to `$RUSTUP_HOME/toolchains/` and `$CARGO_HOME/bin/` on top of the runner image. On warm runs, the toolchain is restored from cache (~3-5 s) instead of installed via rustup (~7-11 s). Save layer short-circuits when the install delta is empty (the common case on hosted runners that already ship rustup + stable). Default "true" (validated end-to-end on Linux/macOS/Windows; see #305/#316/#321/#324/#326/#328/#331/#335/#343). Pass "false" to opt out — useful when the workflow installs components AFTER setup-soldr (the snapshot won't include them) or when the warm-cycle win isn't worth the ~12 s first cold-save.
| no | true |
| solo-toolchain-cache-level | zstd compression level for the solo-toolchain-cache archive. Default "9" — measured save = ~12 s on a 140 MB delta vs "19" which measured at ~104 s (zccache CI v0.9.35, see #310). The archive grows ~25% at -9 (140 MB → 175 MB), restore stays bandwidth-bound at ~70 MB/s either way — the extra MB only adds ~0.5 s per restore. Saves the win only after ≥ ~180 restores at the same key, which is rare in practice (every rustc release / soldr version bump invalidates). Users with truly long-lived workflows can override to "19" or "22".
| no | 9 |
| cache-eviction-policy | Repo-level Actions Cache eviction policy run in the post-step (#347). When the repo's cache usage exceeds the trigger threshold, evict the OLDEST per-commit / per-lockfile entries (cook-delta, build-cache, etc.) until under the target, while NEVER touching foundation prefixes (solo-toolchain, cargo-registry, soldr-mini, setup-cache). Prevents LRU from pushing out the small long-lived caches that deliver the big warm-CI wins. Requires `actions: write` permission on the workflow's GITHUB_TOKEN; falls back to a no-op with a warning if permission is missing. Values:
- "disabled" (default): no eviction. Current behavior.
- "protect-foundations": trigger at 8 GB, target 7 GB.
- "aggressive": trigger at 6 GB, target 5 GB.
| no | disabled |
| prebuild-deps | Pre-build dependencies via `soldr cook` before the workflow's own cargo invocations. "soldr-cook" is the named long-enduring dependency cache mode; "cargo-chef" remains a compatibility alias for older workflows. When the cache hits on the Cargo.lock hash, target/deps/ is pre-warmed so the user's first build starts hot. Empty (default) resolves to "soldr-cook" — every preset (minimal/foundation/full) keeps cook on, so opt out explicitly with `prebuild-deps: none` if you want to skip. Other values reserved for future strategies. (#251 cache-preset)
Cache key is content-addressable on (os, arch, libc, rustc_release, flags_hash, Cargo.lock hash, soldr_version) — same Cargo.lock hits across branches with zero parent-ladder logic. See CLAUDE.md "Cache-lifetime axis".
Skipped when `cache: false` or no Cargo.lock is found. Failures are logged but never fail the action — the user's normal cargo build still runs and succeeds.
| no | soldr-cook |
| prebuild-deps-flags | Additional flags forwarded to `soldr cook`. The profile MUST match what the job actually compiles or the cooked artifacts are never reused: pass empty ("") for dev/debug jobs (cargo check/clippy/doc/test), keep "--release" only for jobs that build a release artifact. Examples: "--release --target x86_64-unknown-linux-musl", "--profile release-lto", "--workspace". These flags are hashed into the cache key — different flags = different cache entry. See README "Match cook to what your job actually compiles".
| no | --release |
| prebuild-deps-delta-cache | When "true" (default), setup-soldr uses soldr's protobuf-backed layered cook cache for compatible soldr releases. The base layer is long-lived and Cargo.lock-oriented; the delta layer is commit/build shape-oriented and should stay small for normal code-only changes. Set to "false" to fall back to the legacy single cook archive for rollback/debugging. Requires soldr 0.7.38 or newer; older releases automatically use the legacy cook cache path.
| no | true |
| cross-targets | Optional newline- or comma-separated list of non-host Rust target triples this job needs to cross-compile to (e.g. `x86_64-pc-windows-gnu`). When set, setup-soldr auto-installs the cross toolchain for each supported (host, target) lane after the Rust toolchain is provisioned and before the user's own steps run.
MVP (issue #104, this release) supports:
- Linux host -> `*-pc-windows-gnu` (any arch): installs
`cargo-zigbuild` + `ziglang` and runs `rustup target add`.
- Linux host -> `*-unknown-linux-musl` (any arch): same install
set.
Unsupported lanes (Windows host, macOS host, msvc / mingw / xwin strategies) emit a one-line `core.warning` describing what would be installed and continue without failing the action — install the cross toolchain manually for those lanes for now. Default empty (cross-bootstrap is opt-in by populating this input).
Caching: when this input is non-empty, setup-soldr activates a per-(host × target) tool cache layer (setup-soldr#106). One independent cache slot per declared target lane holds the lane-specific tool binaries (cargo-zigbuild, ziglang, etc.). Slots are keyed on the lane's resolved tool versions so bumping one tool only invalidates the affected lanes. Non-cross-compiling consumers (empty input) pay zero extra cache-API roundtrips.
| no | "" |
| cross-tool | Cross-compile strategy selector used when `cross-targets` is non-empty. Accepted values: `auto` (default), `none`, `zigbuild`, `xwin`, `mingw`. In this release only `auto` and `none` change behavior — `zigbuild` / `xwin` / `mingw` are accepted for forward-compatibility and currently route through the same `auto` logic for the supported lanes. Set to `none` to skip cross-bootstrap entirely even when `cross-targets` is set.
| no | auto |
| soldr-mini-cache | Cache the soldr binary in its own tiny long-lived layer, keyed only on (version, os, arch, libc). Avoids re-downloading from GitHub Releases when other cache layers (which mix in toolchain hash + cache-key-suffix) invalidate but the soldr binary itself is unchanged. Default "true". Set "false" to disable.
Skipped automatically when `enable: false` or `ref` is set (rebuilding from source — binary content depends on commit not version).
| no | true |