Bump mr-boxington-action to v1.3.1 and mbx to 1.11.1

[jeremy]

Bumps jdx/mr-boxington-action from v1.3.0 to v1.3.1 (a20e1ff), bumps mbx from 1.10.1 to 1.11.1 in the Rust Tests job, and drops the job's MBX_GC_AUTO: "0" env, which the action now sets itself.

From the v1.3.1 release note: "For backend: github with github-cache-mode: objects, the action now defaults MBX_GC_AUTO=0 when RUNNER_ENVIRONMENT is github-hosted and the variable is unset, exporting it before invoking mbx so it applies for the whole job." That is the workaround #188 added by hand, upstreamed (jdx/mr-boxington-action#37).

Checked against the action at the pinned commit: githubObjectGcDefault in src/lib.ts returns "0" exactly for our configuration (default backend: github, github-cache-mode: objects, ubuntu-latest is github-hosted), and main() exports it before setupMbx runs. No step in the job runs mbx before the action, so nothing depended on the job-level env being set earlier. An explicit MBX_GC_AUTO would still be respected, so the env can come back if a different value is ever wanted.

mbx 1.11.0 collapses equivalent C include roots (jdx/mr-boxington#429) so aws-lc's amalgamated bcm.c fits the manifest budget and caches; 1.11.1 bounds learned incremental storage under GC (jdx/mr-boxington#447), refuses NFS-backed build storage (jdx/mr-boxington#428), keeps cargo install --path fingerprints (jdx/mr-boxington#455) and rotates full action-prediction manifests as an LRU instead of refusing new work (jdx/mr-boxington#453, jdx/mr-boxington#456). cache-generation carries over: the v1.11.0...v1.11.1 diff touches the store crate only for manifest export order and import merging, and mbx-cache-core's digest, path-mapping and local CAS modules are untouched, so 1.11.1 stores the same objects under the same keys. The action resolves version against the immutable release and checks the archive against GitHub's asset digest; v1.11.1 is immutable with sha256 digests on every asset.

One 1.11.1 change does reach this job: mbx now runs a cargo metadata probe before every managed cargo command, forwards --config to it, and treats a failed probe as fatal. The conformance runner's mbx deny --config ../../../rust/deny.toml fails that probe (cargo rejects deny.toml as a config file), so rust/Makefile now runs cargo-deny from rust/ with --manifest-path ../conformance/runner/rust/Cargo.toml, which reads the same deny.toml from the working directory. Reproduced and verified locally with the digest-checked mbx 1.11.1 macOS build: make deny CARGO=mbx fails on the old form and passes on the new one, and plain cargo deny accepts the new form too. actionlint and zizmor 1.30 pass locally.

---

Summary by cubic

Bumps jdx/mr-boxington-action to v1.3.1 and mbx from 1.10.1 to 1.11.1 in the Rust Tests job, so the action now provides the MBX_GC_AUTO=0 default and the aws-lc bundle fits the cache manifest.

• Drops the manual MBX_GC_AUTO: "0" env, which the action now sets for object-mode GitHub-hosted jobs.
• mbx 1.11.0 collapses equivalent C include roots so aws-lc's amalgamated bcm.c fits the cache; 1.11.1 doesn't re-key stored objects, so cache-generation carries over.
• Switches make deny to run cargo-deny from rust/ with --manifest-path ../conformance/runner/rust/Cargo.toml, because mbx 1.11.1's mandatory cargo metadata probe rejects deny.toml as a --config file.

^{Written for commit e9deba1. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T21:27:08.816877Z	e9deba1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approved

The pinned release implements and bundles the documented default before any mbx invocation.

Pull request overview

Updates the Rust CI cache action to v1.3.1 and relies on its hosted-runner GC default.

Changes:

• Pins mr-boxington-action to v1.3.1.
• Removes redundant job-level MBX_GC_AUTO=0.
• Documents the action’s new default.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File summaries

File	Description
.github/workflows/test.yml	Updates the cache action and removes redundant configuration.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremy]

Re-pinned from mbx 1.11.0 to 1.11.1 (e9deba1, rebased onto main at 5817850, no conflicts).

Generation carried over. The v1.11.0...v1.11.1 diff touches mbx-cache-store only for manifest export order and imported-manifest merging; mbx-cache-core's digest, path-mapping and local CAS modules are untouched, so 1.11.1 stores the same objects under the same keys. This head bears that out: the Rust Tests job restored main's 1.11.0-written bundle under the unchanged generation (1438 actions, 5572 objects) and the first cargo invocation ran 663 hits / 1 miss against it.

One 1.11.1 behaviour change reached this job. mbx now runs a cargo metadata probe before every managed cargo command, forwards --config to it, and makes a failed probe fatal (jdx/mr-boxington#428). The conformance runner's mbx deny --config ../../../rust/deny.toml therefore failed on the first push (cargo rejects deny.toml as a config file: licenses.confidence-threshold is a float). rust/Makefile now runs cargo-deny from rust/ with --manifest-path ../conformance/runner/rust/Cargo.toml, which reads the same deny.toml from the working directory. Worth raising upstream: an external subcommand's --config is not cargo's.

Rebase. CodeQL default setup started analysing JavaScript/TypeScript once main gained typescript/ (#144); on a head without that directory the analysis fails, so the branch is rebased rather than left on its pre-#144 base.

Local checks (macOS arm64, mbx 1.11.1 downloaded and sha256-verified against the release digest):

• actionlint — exit 0
• zizmor .github/workflows/test.yml (1.30.0) — exit 0, no findings
• make deny CARGO=mbx (1.11.1) — exit 1 on the previous --config form, exit 0 on the --manifest-path form; plain cargo deny accepts the new form too

Copilot last reviewed 865a1f9; a re-review needs a human to request it.

[jeremy]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: e9deba139f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".