ci: race tests/lints/images in parallel; gate publishing on the green verdict (#82)

Push-to-image latency is the target: the release build legs produce the
image artifacts in parallel with ci from the first second (both start
warm off the shared deps cache), and ci itself fans back out into three
independent lanes (x86 tests, arm tests, arm lints) plus the node addon —
wall time is the slowest lane, not a staged pipeline. Shipping moves to
the gate instead: tag-time publish/promote/registry jobs require the
tagged commit's ci run to have concluded green (fail closed if missing).

nix-checks.sh takes an optional attr subset so lanes build only their
slice; every lane still builds deps first and publishes the binary cache
immediately.

Author: eordano

.github/workflows/ci.yml

@@ -124,27 +124,35 @@ jobs:
           path: .win-green-marker
           key: windows-green-${{ needs.windows-gate.outputs.hash }}
 
-  # One staged pipeline per arch, everything on a single runner: deps are
-  # built and published to the binary cache FIRST (a later stage failing
-  # never costs the next run its warm deps), then the source-keyed
-  # build/test/lint work, then the cheap fan-out (image, node addon) reuses
-  # the already-hot store instead of paying setup+restore on fresh runners.
-  pipeline:
-    name: ${{ matrix.system }} pipeline
+  # Everything races in parallel off the shared binary cache: each lane
+  # restores, builds its deps closures, publishes the cache immediately
+  # (no-op unless the key is new), then runs only its slice of the checks.
+  # Image artifacts are produced by the release workflow's build legs,
+  # which start on the same push in parallel with all of this; publishing
+  # is what gates on green, not building.
+  nix-ci:
+    name: ${{ matrix.lane }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - runner: ubuntu-24.04
+          - lane: x86 tests
+            runner: ubuntu-24.04
             system: x86_64-linux
             deps: .#checks.x86_64-linux.deps
-            image: dockerImage
-          - runner: ubuntu-24.04-arm
+            attrs: nextest native-smoke
+          - lane: arm tests
+            runner: ubuntu-24.04-arm
+            system: aarch64-linux
+            deps: .#checks.aarch64-linux.deps
+            attrs: nextest lambda-tests native-smoke
+          - lane: arm lints
+            runner: ubuntu-24.04-arm
             system: aarch64-linux
             deps: .#checks.aarch64-linux.deps .#checks.aarch64-linux.wasm-deps
-            image: lambdaImage
+            attrs: clippy fmt no-node-spawn wasm-check
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 60
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       # No standalone nix installer: the composite runs it with the
@@ -154,27 +162,29 @@ jobs:
       - name: deps (dependency closures)
         run: nix build --no-link ${{ matrix.deps }}
       # Publish immediately and from any branch: the composite no-ops
-      # unless the exact key is new, so this fires once per input rotation.
+      # unless the exact key is new, so this fires once per input rotation
+      # (lanes sharing a key race; first save wins, the rest skip).
       - uses: ./.github/actions/nix-store-cache/save
         continue-on-error: true
-      - name: build + checks
-        run: bash ci/nix-checks.sh ${{ matrix.system }}
-      # Fan-out: cheap on the hot store. Skipped on main pushes, where the
-      # release workflow builds the real thing from the same cache.
-      - name: image smoke (${{ matrix.image }})
-        if: github.event_name != 'push'
-        run: nix build --no-link .#${{ matrix.image }}
+      - name: checks (${{ matrix.attrs }})
+        run: bash ci/nix-checks.sh ${{ matrix.system }} ${{ matrix.attrs }}
+
+  node-addon:
+    name: node addon
+    if: github.event_name != 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - uses: ./.github/actions/rust-setup
-        if: github.event_name != 'push'
         with:
           # Pure consumer of the cache the release napi linux legs save from
           # main pushes (same shared-key); PR-scoped saves would be quota
           # waste.
           workspaces: crate/abgen-node
           shared-key: abgen-node
           save-if: "false"
-      - name: node addon (build + smoke)
-        if: github.event_name != 'push'
+      - name: abgen-node (build + smoke)
         working-directory: crate/abgen-node
         run: |
           npm ci --no-audit --no-fund
@@ -187,4 +197,3 @@ jobs:
           # crate/abgen-node now that the step runs there.
           bash ../../ci/check-glibc-floor.sh 2.34 \
             target/release/libabgen_node.so
-

.github/workflows/release.yml

@@ -701,6 +701,38 @@ jobs:
           path: lambdaImage.tar.gz
           if-no-files-found: error
 
+  # Building races ahead of the test verdict; SHIPPING is what gates on it.
+  # A tag's commit already ran ci when it landed on main — this waits for
+  # that verdict and fails closed if it is missing or red.
+  ci-green:
+    name: ci green gate
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: wait for the commit's ci verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          for _ in $(seq 1 40); do
+            run="$(gh api "/repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$GITHUB_SHA&per_page=1" \
+              --jq '"\(.workflow_runs[0].status // "none") \(.workflow_runs[0].conclusion // "")"')"
+            status="${run%% *}"; conclusion="${run#* }"
+            [ "$conclusion" = "success" ] && exit 0
+            if [ "$status" = "completed" ]; then
+              echo "ci for $GITHUB_SHA concluded: ${conclusion:-none}" >&2
+              exit 1
+            fi
+            echo "ci for $GITHUB_SHA: $status — waiting"
+            sleep 60
+          done
+          echo "timed out waiting for the ci verdict" >&2
+          exit 1
+
   promote:
     name: promote prebuilt targets
     needs: build-id
@@ -797,11 +829,15 @@ jobs:
 
   image:
     name: ghcr image
-    needs: build-id
-    # Tags always run (they push); otherwise only when no prebuilt artifact
-    # exists yet — a non-tag run with a prebuilt would skip every step and
-    # burn a runner fetching an artifact it discards.
-    if: startsWith(github.ref, 'refs/tags/') || needs.build-id.outputs.image_docker == ''
+    needs: [build-id, ci-green]
+    # Tags always run (they push) but only with a green ci verdict for the
+    # commit; otherwise only when no prebuilt artifact exists yet — a
+    # non-tag run with a prebuilt would skip every step and burn a runner
+    # fetching an artifact it discards.
+    if: >-
+      !cancelled() && needs.build-id.result == 'success' &&
+      ((startsWith(github.ref, 'refs/tags/') && needs.ci-green.result == 'success') ||
+       (!startsWith(github.ref, 'refs/tags/') && needs.build-id.outputs.image_docker == ''))
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -875,9 +911,13 @@ jobs:
 
   lambda-image:
     name: ECR lambda image
-    needs: build-id
-    # Same gate as the ghcr image: tags push, non-tag runs only build.
-    if: startsWith(github.ref, 'refs/tags/') || needs.build-id.outputs.image_lambda == ''
+    needs: [build-id, ci-green]
+    # Same gate as the ghcr image: tags push (green ci only), non-tag runs
+    # only build.
+    if: >-
+      !cancelled() && needs.build-id.result == 'success' &&
+      ((startsWith(github.ref, 'refs/tags/') && needs.ci-green.result == 'success') ||
+       (!startsWith(github.ref, 'refs/tags/') && needs.build-id.outputs.image_lambda == ''))
     runs-on: ubuntu-24.04-arm
     permissions:
       contents: read
@@ -980,11 +1020,12 @@ jobs:
 
   napi-publish:
     name: publish @dcl/abgen-node
-    needs: [build-id, napi]
+    needs: [build-id, napi, ci-green]
     runs-on: ubuntu-24.04
     if: >-
       !cancelled() &&
       startsWith(github.ref, 'refs/tags/v') && inputs.dry_run != true &&
+      needs.ci-green.result == 'success' &&
       (needs.napi.result == 'success' ||
        (needs.napi.result == 'skipped' && needs.build-id.outputs.napi_promote == 'true'))
     permissions:
@@ -1046,11 +1087,12 @@ jobs:
           npm publish --access public
 
   publish:
-    needs: [build, promote]
+    needs: [build, promote, ci-green]
     runs-on: ubuntu-24.04
     if: >-
       !cancelled() &&
       startsWith(github.ref, 'refs/tags/v') && inputs.dry_run != true &&
+      needs.ci-green.result == 'success' &&
       needs.build.result != 'failure' && needs.build.result != 'cancelled' &&
       needs.promote.result != 'failure' && needs.promote.result != 'cancelled'
     permissions:

ci/nix-checks.sh

@@ -2,10 +2,17 @@
 
 set -euo pipefail
 
-system="${1:?usage: nix-checks.sh <system>}"
-
-names="$(nix eval --raw ".#checks.${system}" \
-  --apply 'checks: builtins.concatStringsSep "\n" (builtins.attrNames checks)')"
+system="${1:?usage: nix-checks.sh <system> [attr...]}"
+shift || true
+
+# With attr names, build only that subset (lanes split the check set across
+# parallel jobs); without, build every attr the system carries.
+if [ $# -gt 0 ]; then
+  names="$(printf '%s\n' "$@")"
+else
+  names="$(nix eval --raw ".#checks.${system}" \
+    --apply 'checks: builtins.concatStringsSep "\n" (builtins.attrNames checks)')"
+fi
 
 [ -n "$names" ] || { echo "no checks for ${system}" >&2; exit 1; }