Skip to content
Docs

hushrun and sccache

Updated

sccache wraps the compiler and caches its output, for Rust, C, C++, CUDA and more, on local disk or in storage you choose, such as S3 or GitHub Actions' cache. hushrun also reuses compiled Rust crates, on one machine and through your organization's shared store, with rules for whose code each machine may reuse. sccache covers more languages and more places; hushrun covers Rust alone, and adds the trust rules and the skipping of checks and tests.

sccachehushrun
LanguagesRust, C and C++ (gcc, clang, MSVC), CUDA, ROCm HIP, assemblerRust only
How it startsRUSTC_WRAPPER=sccache, for every cargo commandInside hushrun run, after hushrun build on on a person's machine
StorageLocal disk, S3, R2, Redis, Memcached, Google Cloud Storage, Azure, GitHub Actions' cache, WebDAV and more, run by youEach machine's own store, and your organization's shared store on hushrun's hosted service
Who writes the shared copyAny machine you give write access to the storageThe CI of the branches an admin trusts; laptops and sandboxes write only for themselves
Shared between machinesLibraries; not bin, dylib, cdylib or proc-macro cratesLibraries; programs, tests, proc macros and build scripts are reused only on the machine that built them
CIAny CI that reaches the storageGitHub Actions; GitLab CI doesn't take part yet
Distributed compilationYesNo
Skips checks and testsNoYes

How sccache works

sccache is a compiler wrapper in the style of ccache. It keys each compile on its inputs and keeps the output on local disk or in a remote backend. For Rust, you set RUSTC_WRAPPER to sccache, or build.rustc-wrapper in cargo's configuration, and every cargo build goes through it.

Its Rust notes list what it can't cache: crates that invoke the system linker, such as bin, dylib, cdylib and proc-macro crates, and incrementally compiled crates. With CARGO_INCREMENTAL=1 it stops with an error, unless SCCACHE_ALLOW_INCREMENTAL=1 is set.

In GitHub Actions, mozilla-actions/sccache-action installs it, and SCCACHE_GHA_ENABLED stores the cache in GitHub's own. SCCACHE_GHA_RW_MODE=READ_ONLY makes a job read without writing. GitHub's cache holds 10 GB per repository by default, and a run restores caches from its own branch and the default branch, and for a pull request, the base branch.

sccache also does distributed compilation: it can send compiles to build servers, with authentication and sandboxing there.

How hushrun differs

hushrun's build reuse stands between cargo and the compiler inside hushrun run. A compile counts as the same when the compiler, its flags, every file it read and the variables it was told about are the same.

  • Rust only. For C, C++ or CUDA, sccache is the tool. hushrun's compile reuse covers no other language today.
  • Whose code a machine reuses. The repository's trusted code comes only from the CI of branches an admin lists. A pull request reuses it and can't change it. A laptop's code never reaches CI. See Whose code a machine reuses.
  • Sealed. Each crate in the shared store is encrypted with a key that comes from its own inputs, so only someone with the same source, flags and compiler can open it. What that doesn't cover: Security and data.
  • Hosted, with a size per plan. The shared store lives on hushrun's hosted service, with an allowance in each plan (Plans and limits). You don't run a bucket, and you can't point it at your own.
  • Off until an admin turns it on, and then it starts by watching: machines compare, and reuse nothing, until an admin chooses Start reusing.
  • Narrower reach. Only hushrun run NAME -- COMMAND shares, only on GitHub Actions in CI, and not on Windows. Programs, tests, proc macros and build scripts are compiled on each machine, though a machine's own store reuses them.
  • It also skips work. The same hushrun run skips a whole check that passed on these files, and can leave out tests that passed on the files they read.

hushrun publishes no speed numbers for its compile reuse yet. The build: lines in these docs are examples of its output.

Using both

Not in the same job. Where RUSTC_WRAPPER is set, hushrun's build reuse turns itself off for that run, and says so in one line. Two ways to split them:

  • sccache for C and C++, hushrun for Rust. sccache wraps a C or C++ compile when you prefix the compiler, or through CMake's CMAKE_C_COMPILER_LAUNCHER and CMAKE_CXX_COMPILER_LAUNCHER, with no RUSTC_WRAPPER, so a job can use both.
  • hushrun for checks, sccache for compiles. Keep RUSTC_WRAPPER=sccache and wrap your checks in hushrun run. Checks and tests still skip; compiled code comes from sccache.

Which to choose

  • Choose sccache for C, C++ or CUDA, for storage you run yourself, for GitLab CI or another CI today, or for distributed compilation.
  • Choose hushrun's shared store for a Rust repository on GitHub Actions where you want laptops and agents' sandboxes to start from what main's CI compiled, and never let a laptop or a pull request write what CI ships.
  • For one repository on GitHub Actions, sccache with GitHub's cache, or plain caching, may be all you need.

Sources

Checked on 2026-11-14:

Markdown