From 910bb563f03b56e4363a48d1490dbfd994c72f6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Gruszczy=C5=84ski?=
 <mateusz.gruszczynski@firma.interia.pl>
Date: Wed, 14 Oct 2026 13:13:32 +0200
Subject: [PATCH] cleaups

---
 README.md                | 13 +++++++++++++
 scripts/build-release.sh |  2 ++
 scripts/lib.sh           | 38 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 53 insertions(+)

diff --git a/README.md b/README.md
index 6541bbb..c1f1718 100644
--- a/README.md
+++ b/README.md
@@ -289,3 +289,16 @@ Jeżeli istnieje starsze `last_commit` oraz poprawne APT/RPM dla tego SHA, zosta
 ## FreeBSD patch version detection
 
 The OPNsense branch reuses the Cargo package `VERSION` already detected by the main build pipeline. If `apply-freebsd-patches.sh` is run manually, it falls back to `RUST_PROXY_PYTHON` (`/usr/bin/python3.11`) so Rocky Linux 9's default Python 3.9 does not cause a missing `tomllib` error.
+
+### Czyszczenie cache Cargo
+
+Po **udanym opublikowaniu pakietów** każdej gałęzi (Linux/OPNsense) builder
+usuwa `target/**/incremental` i `target/debug`, a także pliki starsze
+niż 30 dni z `target/release/deps` oraz
+`target/x86_64-unknown-freebsd/release/deps`. Zachowuje aktualne artefakty
+release, fingerprinty oraz cache zależności, więc kolejne buildy nie startują
+od zera. Starsze usunięte zależności mogą wymagać pojedynczej rekompilacji.
+
+Ustawienia środowiskowe: `CLEAN_TARGET_AFTER_BUILD=0` wyłącza czyszczenie;
+`TARGET_CACHE_MAX_AGE_DAYS=30` określa wiek nieużywanych plików.
+
diff --git a/scripts/build-release.sh b/scripts/build-release.sh
index d5b1699..40ad0ca 100755
--- a/scripts/build-release.sh
+++ b/scripts/build-release.sh
@@ -110,6 +110,7 @@ OPNSENSE_OK=1
 if [[ "$BUILD_LINUX" == "1" ]]; then
     if /opt/rust-package-builder/scripts/build-linux-release.sh; then
         log "Linux branch completed for $SHA"
+        cleanup_cargo_target
     else
         LINUX_OK=0
         log "ERROR: Linux branch failed for $SHA; OPNsense branch will still run"
@@ -119,6 +120,7 @@ fi
 if [[ "$BUILD_OPNSENSE" == "1" ]]; then
     if /opt/rust-package-builder/scripts/build-opnsense-release.sh; then
         log "OPNsense branch completed for $SHA"
+        cleanup_cargo_target
     else
         OPNSENSE_OK=0
         log "ERROR: OPNsense branch failed for $SHA"
diff --git a/scripts/lib.sh b/scripts/lib.sh
index e35d6cb..7b764da 100755
--- a/scripts/lib.sh
+++ b/scripts/lib.sh
@@ -42,3 +42,41 @@ atomic_write() {
     cat > "$tmp"
     mv -f "$tmp" "$path"
 }
+
+# Keep Cargo's release dependency cache so subsequent builds remain incremental.
+# Run only after a branch has successfully published its packages.
+cleanup_cargo_target() {
+    [[ "${CLEAN_TARGET_AFTER_BUILD:-1}" == "1" ]] || return 0
+
+    local target="${CARGO_TARGET_DIR:-}"
+    local expected="${DATA_DIR:-}/cargo/target"
+    # Never recursively delete an arbitrary path provided via environment.
+    if [[ -z "$target" || "$target" != "$expected" || ! -d "$target" || -L "$target" ]]; then
+        log "Cargo target cleanup skipped: unexpected target directory"
+        return 0
+    fi
+
+    local days="${TARGET_CACHE_MAX_AGE_DAYS:-30}"
+    if [[ ! "$days" =~ ^[0-9]+$ ]] || (( days < 1 )); then
+        log "Cargo target cleanup skipped: invalid TARGET_CACHE_MAX_AGE_DAYS=$days"
+        return 0
+    fi
+
+    local before after
+    before=$(du -sk "$target" 2>/dev/null | awk '{print $1}')
+
+    # Release dependencies, fingerprints and build scripts remain cached.
+    # Rust incremental data is disposable; debug output is unused by release builds.
+    find "$target" -type d -name incremental -prune -exec rm -rf -- {} + 2>/dev/null || true
+    if [[ -d "$target/debug" && ! -L "$target/debug" ]]; then
+        rm -rf -- "$target/debug" || true
+    fi
+
+    # Expire old compiled dependency files gradually, not the entire target.
+    # Fresh build outputs stay available for subsequent Cargo invocations.
+    find "$target/release/deps" "$target/x86_64-unknown-freebsd/release/deps" \
+        -maxdepth 1 -type f -mtime "+$days" -delete 2>/dev/null || true
+
+    after=$(du -sk "$target" 2>/dev/null | awk '{print $1}')
+    log "Cargo target cleanup: reclaimed $(( ${before:-0} - ${after:-0} )) KiB (cache retained)"
+}