Infrastructure Team 2026 Q3 Recap and Q4 Plan

Oct. 12, 2026 · Marco Ieni on behalf of The Rust Infrastructure Team

Here's what the Infrastructure Team delivered in Q3 2026 and what we're focusing on in Q4.

You can find the previous blog post of this series here.

Q3 2026 Accomplishments

Audit logs in Datadog Cloud SIEM

We enabled audit logs for the following services and sent them to Datadog, so that the Rust Foundation security team can analyze them using Cloud SIEM:

  • The Rust GitHub Enterprise and the Rust Foundation GitHub Enterprise, via audit log streaming.
  • AWS, via CloudTrail.
  • Heroku, Wiz, Fastly, and Datadog itself.

See the GitHub issue for more details.

Web Application Firewall and DDoS protection for crates.io and docs.rs

Together with the crates.io and docs.rs teams, we set up the Fastly Next-Gen WAF (Web Application Firewall) for docs.rs and crates.io (see the GitHub issue). The WAF blocks potential security threats and enforces rate limits.

We also enabled Fastly DDoS protection for both services.

Together, these helped us mitigate DDoS attacks against crates.io this quarter, and reduce the load on the docs.rs server.

CDN improvements for crates.io and docs.rs

We made several improvements to the Fastly configuration of crates.io and docs.rs:

  • Faster crate downloads processing: We removed a regex from the Fastly code that handles crate downloads, and did some other optimizations (#1095, #1096). Requests now take 10% less compute time in the Fastly CDN nodes. Most users won't notice the difference, since networking dominates download latency, but it makes our CDN setup more efficient and sustainable.
  • Content-Length in HEAD responses: Fastly HEAD responses now include the Content-Length header for non-compressible artifacts such as .crate files. This fixes some issues encountered when using Buck2.
  • crates.io static assets served from the edge: GET and HEAD requests for READMEs and other static assets of crates.io are now resolved by the CDN instead of the crates.io web app hosted on Heroku.
  • docs.rs CDN logs in Datadog: The docs.rs Fastly service now sends its logs to Datadog (#1196, #1197, #1226), giving us better observability of the service.
  • CloudFront traffic: In the past months, we sent 100% of crates and releases download traffic over Fastly to spend our AWS credits on other resources. We restored a small share of traffic (approximately 0.4%) over CloudFront to make sure it keeps working as intended, in case we need to fall back to it.

New message queue between crates.io and docs.rs

We provisioned an AWS SQS FIFO queue that crates.io can use to notify docs.rs about new releases.

The queue is meant to replace the crates.io git index for this use case. It's currently unused for lack of engineering time from the crates.io team.

Renovate for the rust repository

We configured Renovate for the rust-lang/rust repository (see the configuration file). Renovate automatically opens PRs to fix security findings and update Cargo lockfiles and GitHub Actions.

From the dependency dashboard, maintainers can ask Renovate to update individual dependencies when they want to. You can see all the PRs opened by Renovate here.

GitHub security alerts

We enabled Dependabot alerts in the rust-lang GitHub organization. This means that:

  • Maintainers receive alerts for vulnerabilities affecting their repositories.
  • Maintainers can see these vulnerabilities at https://github.com/rust-lang/<repo>/security/dependabot.
  • If configured, Renovate can open PRs to fix these vulnerabilities. See the Renovate docs to learn more.

Note that this setting doesn't enable automatic Dependabot PRs. That's a separate setting called "Dependabot security updates", which we don't plan to enable because we prefer using Renovate.

More settings configured in the team repo

We keep moving manually configured settings into Infrastructure as Code (IaC) in the team repository:

  • GitHub Pages: Rust Project members can now set up GitHub Pages for their repositories by opening a PR. See the docs and an example. Thanks to cuba0001 for working on this!
  • Custom Properties: GitHub Custom Properties are now configurable in the team repo. This allows repositories to opt in to automations developed by the Infrastructure Team.

Hardware security keys

As a follow-up to the hardware security keys work we did in Q2, we added a convention in the team repository for Project members who want to share the PIV attestation certificates extracted from their YubiKeys. We can validate these certificates against our inventory of hardware keys through their serial numbers.

More details in the docs.

GitHub Actions audits

We deployed the crabwatch workflow to audit GitHub Actions workflows in the rust-lang GitHub organization. We enabled 23 Zizmor audits by default, and we want to enable more in the future! In the meantime, project members can override what audits run in their repositories.

Thanks to Sandra, the Outreachy intern who helped us work on this! You can read about her internship experience in her blog.

Improving user experience of reviewers

Our merge queue bot (bors) is now able to gate approvals on pull request CI success in the rust-lang/rust repository. This makes it easier for reviewers to approve pull requests without having to babysit them until PR CI succeeds.

Trusted contributors

The Rust Project created a trusted-contributors marker team for trusted contributors who are not members of rust-lang teams but regularly contribute to rust-lang/rust. This team has try and perf permissions, so that these contributors can start try builds and performance runs independently, without repeatedly asking a Project member to delegate permissions.

Learn more about membership in the Forge docs.

More powerful dev desktops and Rust Playground

We upgraded the EC2 instances of the dev desktops and the Rust Playground to make these services faster for Rust contributors and the Rust community:

  • Playground: from c5a.large to c7a.xlarge (PR).
  • Dev desktops (PR):
    • dev-desktop-eu-1: from c6g.8xlarge to c9g.8xlarge.
    • dev-desktop-us-1: from c7g.12xlarge to c9g.12xlarge.

We also increased the disk quota to 200GB per user on all four dev desktops (#1182, #1187).

Learn more about dev desktops in the Forge docs.

ARM machine for rustc-perf

We provisioned an EC2 m9g.metal-48xl instance to run rustc-perf on ARM. This allows the compiler team to measure optimizations done for the ARM architecture.

New CI runners

In partnership with Canonical, we enabled new External GitHub Actions runners for the Rust Project:

We also enabled three large ARM GitHub Actions runners (8 vCPU, 32 GB RAM) for the rustls organization, covering Ubuntu 24.04, Ubuntu 26.04, and Windows 11. This additional CI capacity is sponsored by ARM.

riscv64gc-unknown-linux-musl promoted to tier 2 with host tools

We promoted the riscv64gc-unknown-linux-musl target to tier 2 with host tools. RISC-V users targeting musl no longer need to compile Rust tools like rustc and cargo themselves.

On-call rotation moved to Datadog

Since the Rust Foundation joined Datadog's Open Source Program, we migrated the Rust Foundation on-call rotation from PagerDuty to Datadog On-Call. This allows us to save money and to remove one service from our dependencies.

Team leader rotation

We established a new policy for the Infrastructure Team leader.

As a result, we rotated one team leader: Marco took the place of JD.

Main branch

We renamed the default branch of 25 repositories to main: lang-team, rustc-hash, rustc-perf, rust-artwork, .github, compiler-team-prioritization, project-ffi-unwind, project-safe-transmute, wg-allocators, wg-cargo-std-aware, futures-rs, pin-utils, thanks, rust-forge, triagebot, mdBook, portable-simd, rustup-components-history, std-dev-guide, polonius, cargo-bisect-rustc, rust-mode, rust.vim, types-team, rfcs.

Among public repositories in the rust-lang organization that are neither archived nor forks, 113 use main and 56 still use master.

Trusted publishing

We converted 7 crates to use trusted publishing:

Triagebot Assign-priority command

We improved and added a shortcut to the assign-priority command (e747558e), see docs on the forge.

Q4 2026 Plans

Finish Q3 goals

In Q3, we didn't manage to finish all our goals, so we will continue working on them in Q4:

  • Improve access controls for Rust infrastructure with SAML SSO.
  • Move mailing lists from Mailgun to Google Groups to reduce spam.
  • Consolidate logs on Datadog.
  • Stricter networking access rules for crater agents.

You can read more about these goals in our Q3 2026 plan.

Secure deployments

Today, we deploy infrastructure from our personal laptops. Instead, we want to deploy from a secure environment with strong access controls, where access is limited to the people who maintain the deployment processes. Deploying from a centralized environment also makes it easier to automate deployments and to monitor for unauthorized access or suspicious activity.

As a first step, we want to simplify our Infrastructure as Code setup, which currently uses both Terraform and Terragrunt. We want to investigate whether it is still worth using both tools (see the GitHub issue).

After simplifying the setup, we will decide how to automate deployments and start automating them.

Decommission the monitoring instance

As part of our move to Datadog, we want to decommission our self-hosted monitoring instance, which runs Prometheus, Alertmanager and Grafana.

Join us

If you're interested in contributing to Rust's infrastructure, have a look at the infra-team repository to learn more about us and reach out on Zulip.

We are always looking for new contributors!