merge main (parallel lanes CI, lz4 lint fix)

# Conflicts:
#	ci/artifact-hashes/aarch64-apple-darwin.sha256
#	ci/artifact-hashes/aarch64-pc-windows-gnullvm.sha256
#	ci/artifact-hashes/aarch64-unknown-linux-gnu.sha256
#	ci/artifact-hashes/x86_64-apple-darwin.sha256
#	ci/artifact-hashes/x86_64-pc-windows-gnu.sha256
#	ci/artifact-hashes/x86_64-unknown-linux-gnu.sha256

Author: eordano

.github/workflows/ci.yml

@@ -124,27 +124,35 @@ jobs:
           path: .win-green-marker
           key: windows-green-${{ needs.windows-gate.outputs.hash }}
 
-  # One staged pipeline per arch, everything on a single runner: deps are
-  # built and published to the binary cache FIRST (a later stage failing
-  # never costs the next run its warm deps), then the source-keyed
-  # build/test/lint work, then the cheap fan-out (image, node addon) reuses
-  # the already-hot store instead of paying setup+restore on fresh runners.
-  pipeline:
-    name: ${{ matrix.system }} pipeline
+  # Everything races in parallel off the shared binary cache: each lane
+  # restores, builds its deps closures, publishes the cache immediately
+  # (no-op unless the key is new), then runs only its slice of the checks.
+  # Image artifacts are produced by the release workflow's build legs,
+  # which start on the same push in parallel with all of this; publishing
+  # is what gates on green, not building.
+  nix-ci:
+    name: ${{ matrix.lane }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - runner: ubuntu-24.04
+          - lane: x86 tests
+            runner: ubuntu-24.04
             system: x86_64-linux
             deps: .#checks.x86_64-linux.deps
-            image: dockerImage
-          - runner: ubuntu-24.04-arm
+            attrs: nextest native-smoke
+          - lane: arm tests
+            runner: ubuntu-24.04-arm
+            system: aarch64-linux
+            deps: .#checks.aarch64-linux.deps
+            attrs: nextest lambda-tests native-smoke
+          - lane: arm lints
+            runner: ubuntu-24.04-arm
             system: aarch64-linux
             deps: .#checks.aarch64-linux.deps .#checks.aarch64-linux.wasm-deps
-            image: lambdaImage
+            attrs: clippy fmt no-node-spawn wasm-check
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 60
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       # No standalone nix installer: the composite runs it with the
@@ -154,27 +162,29 @@ jobs:
       - name: deps (dependency closures)
         run: nix build --no-link ${{ matrix.deps }}
       # Publish immediately and from any branch: the composite no-ops
-      # unless the exact key is new, so this fires once per input rotation.
+      # unless the exact key is new, so this fires once per input rotation
+      # (lanes sharing a key race; first save wins, the rest skip).
       - uses: ./.github/actions/nix-store-cache/save
         continue-on-error: true
-      - name: build + checks
-        run: bash ci/nix-checks.sh ${{ matrix.system }}
-      # Fan-out: cheap on the hot store. Skipped on main pushes, where the
-      # release workflow builds the real thing from the same cache.
-      - name: image smoke (${{ matrix.image }})
-        if: github.event_name != 'push'
-        run: nix build --no-link .#${{ matrix.image }}
+      - name: checks (${{ matrix.attrs }})
+        run: bash ci/nix-checks.sh ${{ matrix.system }} ${{ matrix.attrs }}
+
+  node-addon:
+    name: node addon
+    if: github.event_name != 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - uses: ./.github/actions/rust-setup
-        if: github.event_name != 'push'
         with:
           # Pure consumer of the cache the release napi linux legs save from
           # main pushes (same shared-key); PR-scoped saves would be quota
           # waste.
           workspaces: crate/abgen-node
           shared-key: abgen-node
           save-if: "false"
-      - name: node addon (build + smoke)
-        if: github.event_name != 'push'
+      - name: abgen-node (build + smoke)
         working-directory: crate/abgen-node
         run: |
           npm ci --no-audit --no-fund
@@ -187,4 +197,3 @@ jobs:
           # crate/abgen-node now that the step runs there.
           bash ../../ci/check-glibc-floor.sh 2.34 \
             target/release/libabgen_node.so
-

.github/workflows/release.yml

@@ -701,6 +701,38 @@ jobs:
           path: lambdaImage.tar.gz
           if-no-files-found: error
 
+  # Building races ahead of the test verdict; SHIPPING is what gates on it.
+  # A tag's commit already ran ci when it landed on main — this waits for
+  # that verdict and fails closed if it is missing or red.
+  ci-green:
+    name: ci green gate
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: wait for the commit's ci verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          for _ in $(seq 1 40); do
+            run="$(gh api "/repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$GITHUB_SHA&per_page=1" \
+              --jq '"\(.workflow_runs[0].status // "none") \(.workflow_runs[0].conclusion // "")"')"
+            status="${run%% *}"; conclusion="${run#* }"
+            [ "$conclusion" = "success" ] && exit 0
+            if [ "$status" = "completed" ]; then
+              echo "ci for $GITHUB_SHA concluded: ${conclusion:-none}" >&2
+              exit 1
+            fi
+            echo "ci for $GITHUB_SHA: $status — waiting"
+            sleep 60
+          done
+          echo "timed out waiting for the ci verdict" >&2
+          exit 1
+
   promote:
     name: promote prebuilt targets
     needs: build-id
@@ -797,11 +829,15 @@ jobs:
 
   image:
     name: ghcr image
-    needs: build-id
-    # Tags always run (they push); otherwise only when no prebuilt artifact
-    # exists yet — a non-tag run with a prebuilt would skip every step and
-    # burn a runner fetching an artifact it discards.
-    if: startsWith(github.ref, 'refs/tags/') || needs.build-id.outputs.image_docker == ''
+    needs: [build-id, ci-green]
+    # Tags always run (they push) but only with a green ci verdict for the
+    # commit; otherwise only when no prebuilt artifact exists yet — a
+    # non-tag run with a prebuilt would skip every step and burn a runner
+    # fetching an artifact it discards.
+    if: >-
+      !cancelled() && needs.build-id.result == 'success' &&
+      ((startsWith(github.ref, 'refs/tags/') && needs.ci-green.result == 'success') ||
+       (!startsWith(github.ref, 'refs/tags/') && needs.build-id.outputs.image_docker == ''))
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -875,9 +911,13 @@ jobs:
 
   lambda-image:
     name: ECR lambda image
-    needs: build-id
-    # Same gate as the ghcr image: tags push, non-tag runs only build.
-    if: startsWith(github.ref, 'refs/tags/') || needs.build-id.outputs.image_lambda == ''
+    needs: [build-id, ci-green]
+    # Same gate as the ghcr image: tags push (green ci only), non-tag runs
+    # only build.
+    if: >-
+      !cancelled() && needs.build-id.result == 'success' &&
+      ((startsWith(github.ref, 'refs/tags/') && needs.ci-green.result == 'success') ||
+       (!startsWith(github.ref, 'refs/tags/') && needs.build-id.outputs.image_lambda == ''))
     runs-on: ubuntu-24.04-arm
     permissions:
       contents: read
@@ -980,11 +1020,12 @@ jobs:
 
   napi-publish:
     name: publish @dcl/abgen-node
-    needs: [build-id, napi]
+    needs: [build-id, napi, ci-green]
     runs-on: ubuntu-24.04
     if: >-
       !cancelled() &&
       startsWith(github.ref, 'refs/tags/v') && inputs.dry_run != true &&
+      needs.ci-green.result == 'success' &&
       (needs.napi.result == 'success' ||
        (needs.napi.result == 'skipped' && needs.build-id.outputs.napi_promote == 'true'))
     permissions:
@@ -1046,11 +1087,12 @@ jobs:
           npm publish --access public
 
   publish:
-    needs: [build, promote]
+    needs: [build, promote, ci-green]
     runs-on: ubuntu-24.04
     if: >-
       !cancelled() &&
       startsWith(github.ref, 'refs/tags/v') && inputs.dry_run != true &&
+      needs.ci-green.result == 'success' &&
       needs.build.result != 'failure' && needs.build.result != 'cancelled' &&
       needs.promote.result != 'failure' && needs.promote.result != 'cancelled'
     permissions:

ci/artifact-hashes/aarch64-apple-darwin.sha256

@@ -1,4 +1,4 @@
-e3877da86c1adf86f1925a7f23346272d76aa410ef1df5eec03c5a09386dac00  abgen
-483e46701e2b2a57e2a319704b8e4aa35c5dd87c542cc51dafe64a5ee4957e4e  abgen-host
-d1571fc54361961b7f879f7f441a1f55843407621d7cebc5b367239c2e05ca5d  libabgen.a
-a95733151307dc851f622d7e2668dc1f197dcfcd0dc14871a071408223db4e86  libabgen.dylib
+ef8fd150d34c41a1a5b99235699418a5c5fbf241d4ebd878b3a1c0162eb17f38  abgen
+1da948b0f25bbf6a08eab696c88364ba8f757786f4f67ee665fb711edc6d610a  abgen-host
+dce6be9b3be156900901b876828c458f54b9a9651eb9513c3df82f5648752c38  libabgen.a
+4d56cae697cf6f5361e567ec07bf72f5fd8b9c877a331824d185e6093731c9cb  libabgen.dylib

ci/artifact-hashes/aarch64-pc-windows-gnullvm.sha256

@@ -1,4 +1,4 @@
-c1edb921fae16a583afa65cd5cb8a72a3507a213cddc94c9feabdc0032e70dc4  abgen-host.exe
-78c73949d29e35304d6013876d5838d6464d3c574377918716792a852ceb6530  abgen.dll
-1a2b8c88925195356079f2a73925c4c980a6b519a06ca12ead2dc9d55083f40c  abgen.exe
-5561ac841a7f576e9b9a70cdb210a526592393bbee1ef01bd847aac032373071  libabgen.a
+d4808081567358060abd293383a285086399b279a11720e41fe0c8c07792f8b5  abgen-host.exe
+935ad502bded6f44bfc3484dd021f80b4641705c298f925c109da8bb81a91a94  abgen.dll
+5fc6635db86777cc628d5529949f650fc1bc07b8d8f004a1b9d88340019f332d  abgen.exe
+3ce5a8d6a48772d6ce22af031254e8ccdc06a73f61df94ecf7d38736f5f42b57  libabgen.a

ci/artifact-hashes/aarch64-unknown-linux-gnu.sha256

@@ -1,4 +1,4 @@
-80d0b59f7a48cf29af7b926318b36f512c7a06e9e3b6f9d1c25b2f5786a3683b  abgen
-be1da3013c667c48aca9416beeb7007321ea0eae24d9d2e48de4c0cf43fc773d  abgen-host
-baba09f755ea660df8bc4475b774b3759be09bcfd392267a653cfc191928483d  libabgen.a
-5501ac16c806ba686428313753b38020ffda49675922ad1cf2c9d4110f02cdc8  libabgen.so
+cdbbb65bb03646ddbd4861d215a5227cb9ccb272e4e7bd738bd080ad5ea5b9e8  abgen
+d096f4d8a5e2b27895205150a0879fa784e3d111b8c404f3e6a8d6983771c013  abgen-host
+24a8e4bbd65375bc205a891e804714f7145916f63bc14fd9c18f164e726d5ef3  libabgen.a
+8752e467191f1f4fd8567e333de3aaa7f85cf4d513a210ac1f4659175f76e0e1  libabgen.so

ci/artifact-hashes/x86_64-apple-darwin.sha256

@@ -1,4 +1,4 @@
-992ba0a5f35beb5ed565dd4737e9a716c4932540b4e8e46113861fc3d6217946  abgen
-3e3862c5c2df546cf14e514ce6f9290fbd190e194640cd1b17fda461c5e2af4a  abgen-host
-c70b75c4bdbb42e9071721e74f70d02971689f6d719f277605ec3634652eb0cb  libabgen.a
-421a17b321b7c168aa81f923196e84ca77715768f9f5f208af12f85cb77dd631  libabgen.dylib
+6545fe7c7961f5ab4e233bc72c5c49c5b6989224ccd022372a1319b10f5681c6  abgen
+1b3f6a7d2d72f8c1015a98f2775df134b3153aa8fbfbcca141871bb1b80ccbea  abgen-host
+374b91496930375be4710b881b483facc054ea9257b050e6c06f3c6a431672a8  libabgen.a
+aaa5fd7502bd4f8dab229c0417cdce4b9ab495708e9e0bd6d89c4bf1f8fce18d  libabgen.dylib

ci/artifact-hashes/x86_64-pc-windows-gnu.sha256

@@ -1,4 +1,4 @@
-cb6c959d4a0a4ebd524592f2b4d45d52aef2559e709251d40836be10d543bb03  abgen-host.exe
-7486ae225bac514f54609e6ec2d668f051d22426af735c6efb943a6d35a5201c  abgen.dll
-a406f5dba5a4a59505c2ef38eb6e4f7c7375905a752a65c36b7489c16124f3a6  abgen.exe
-9aceeeba26ed86d206bf606b99d8f9df5610222e44dbadd1b93f51108a040139  libabgen.a
+166a0827b277a121a25b92ac6898c7e75ff9fa15e9d543ab5b2791129f1669dd  abgen-host.exe
+5db801c7a094320ee79c312729f55872a0c297dd5bd6ee3d99d4c951cf351c9f  abgen.dll
+8ad1ae79ad541bca088720298aeabc7907ac56faba8b713004258c8ae5e1cf7b  abgen.exe
+8da09759799bf7469af8f6d54c24e44aeb183b069e8a7c863943081f39289222  libabgen.a

ci/artifact-hashes/x86_64-unknown-linux-gnu.sha256

@@ -1,4 +1,4 @@
-070febd019c81907e56c1e3984d7df979366652afdb0b0017227c156880e816b  abgen
-d2fab62119042218561b337d6ec3b47cb87fd66881f73b42e836a9ac1c85da45  abgen-host
-a555f1a11e1ba949452950080aebbed72decd4668b29f76b10fc79a8ab0424c2  libabgen.a
-3123fa79d3a8fc0a8cd473fd1436114981df4ea88828aea8671339304ead1085  libabgen.so
+edd5aed02a135aeda158f8eadfe89567bd8d1c5216537a39c3fed373262ab2fd  abgen
+0b02c02cd48179088fa448f64bac876ad3c85da913bf731c00a09a5824a05085  abgen-host
+cfa42ad0993b53d0ca6dd01bf736776663ba921b2f0163aa5f67ce7b2df5c0cf  libabgen.a
+eb4c8a225d543ade5a0ede260fa75b94db8b9dc474777e856b5ad9a091104292  libabgen.so

ci/nix-checks.sh

@@ -2,10 +2,17 @@
 
 set -euo pipefail
 
-system="${1:?usage: nix-checks.sh <system>}"
-
-names="$(nix eval --raw ".#checks.${system}" \
-  --apply 'checks: builtins.concatStringsSep "\n" (builtins.attrNames checks)')"
+system="${1:?usage: nix-checks.sh <system> [attr...]}"
+shift || true
+
+# With attr names, build only that subset (lanes split the check set across
+# parallel jobs); without, build every attr the system carries.
+if [ $# -gt 0 ]; then
+  names="$(printf '%s\n' "$@")"
+else
+  names="$(nix eval --raw ".#checks.${system}" \
+    --apply 'checks: builtins.concatStringsSep "\n" (builtins.attrNames checks)')"
+fi
 
 [ -n "$names" ] || { echo "no checks for ${system}" >&2; exit 1; }