Add shared dev-workspace setup script and harden CI workflow

Extract venv creation/validation into scripts/setup-dev-workspace.sh so
CI and the devcontainer install the same editable local sources instead
of drifting apart. Update the CI workflow to use it, add per-branch
concurrency cancellation, cache all monorepo venvs, run inspect_code/
audit_code/check_formatting steps, support Windows venv paths, and bump
upload-artifact to v5.

Author: Aksem

.github/workflows/ci-cd.yml

@@ -1,4 +1,3 @@
-# TODO: check formatting
 # TODO: lock files on all platforms
 # TODO: test with all supported python versions
 name: CI
@@ -15,6 +14,14 @@ on:
         type: boolean
         default: false
 
+# Cancel superseded runs only for PR pushes (rapid commits to the same branch).
+# Never cancel push/tag/merge_group runs — a tag push drives the PyPI publish
+# steps below and a merge_group run backs a required check in the merge queue;
+# either could be silently aborted by an unrelated event sharing the ref.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 defaults:
   run:
     shell: bash
@@ -27,18 +34,21 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 40
     strategy:
       fail-fast: false
-      max-parallel: 1
       matrix:
         os: [ubuntu-24.04, macos-15, windows-2022]
         include:
           - os: ubuntu-24.04
             name: Linux
+            venv_bin: bin
           - os: macos-15
             name: macOS
+            venv_bin: bin
           - os: windows-2022
             name: Windows
+            venv_bin: Scripts
 
     steps:
       - uses: actions/checkout@v5
@@ -53,32 +63,62 @@ jobs:
         with:
           python-version: ${{ env.DEV_WORKSPACE_PYTHON_VERSION }}
 
+      # Every package in the monorepo has its own .venvs/ (root dev_workspace plus one
+      # per project for envs created by `prepare-envs`, e.g. dev_no_runtime, runtime).
+      # Exact-match only (no restore-keys): setup-dev-workspace.sh and prepare-envs
+      # skip reinstalling whenever a restored venv already looks valid, so a stale
+      # partial-match restore could mask a dependency that was added since the cache
+      # was written.
+      - name: Cache all venvs
+        uses: actions/cache@v4
+        with:
+          path: |
+            .venvs
+            **/.venvs
+          key: ${{ runner.os }}-venvs-${{ hashFiles('**/pyproject.toml', '**/preset.toml') }}
+
       - name: Install dependencies
         run: |
-          pipx run finecode bootstrap
-          source .venvs/dev_workspace/bin/activate
+          # CI must exercise this branch's local source, so finecode and its sibling
+          # packages need an editable install, not a released version from PyPI — see
+          # docs/guides/developing-finecode.md#continuous-integration.
+          sh scripts/setup-dev-workspace.sh
+          source .venvs/dev_workspace/${{ matrix.venv_bin }}/activate
+        shell: bash
+
+      - name: Inspect code
+        if: ${{ !cancelled() }}
+        run: |
+          source .venvs/dev_workspace/${{ matrix.venv_bin }}/activate
+          python -m finecode run inspect_code
+        shell: bash
 
-          python -m finecode prepare-envs
+      - name: Audit code
+        if: ${{ !cancelled() }}
+        run: |
+          source .venvs/dev_workspace/${{ matrix.venv_bin }}/activate
+          python -m finecode run audit_code
         shell: bash
 
-      - name: Lint
+      - name: Check formatting
+        if: ${{ !cancelled() }}
         run: |
-          source .venvs/dev_workspace/bin/activate
-          python -m finecode run lint
+          source .venvs/dev_workspace/${{ matrix.venv_bin }}/activate
+          python -m finecode run check_formatting
         shell: bash
 
       - name: Build artifacts
         id: build
-        if: runner.os == 'Linux'
+        if: runner.os == 'Linux' && !cancelled()
         run: |
-          source .venvs/dev_workspace/bin/activate
+          source .venvs/dev_workspace/${{ matrix.venv_bin }}/activate
           python -m finecode run build_artifact
         shell: bash
 
       - name: Run unit tests
         if: ${{ !cancelled() }}
         run: |
-          source .venvs/dev_workspace/bin/activate
+          source .venvs/dev_workspace/${{ matrix.venv_bin }}/activate
           # TODO: test with all supported python versions
           python -m finecode run run_tests
         shell: bash
@@ -89,7 +129,7 @@ jobs:
           FINECODE_CONFIG_PUBLISH_AND_VERIFY_ARTIFACT__INIT_REPOSITORY_PROVIDER__REPOSITORIES: '[{"name": "testpypi", "url": "https://test.pypi.org/"}]'
           FINECODE_CONFIG_PUBLISH_AND_VERIFY_ARTIFACT__INIT_REPOSITORY_PROVIDER__CREDENTIALS_BY_REPOSITORY: '{"testpypi": {"username": "${{ secrets.TESTPYPI_USERNAME }}", "password": "${{ secrets.TESTPYPI_PASSWORD }}"}}'
         run: |
-          source .venvs/dev_workspace/bin/activate
+          source .venvs/dev_workspace/${{ matrix.venv_bin }}/activate
           python -m finecode run \
             --map-payload-fields="src-artifact-def-path,dist-artifact-paths" \
             publish_and_verify_artifact \
@@ -104,7 +144,7 @@ jobs:
           FINECODE_CONFIG_PUBLISH_AND_VERIFY_ARTIFACT__INIT_REPOSITORY_PROVIDER__CREDENTIALS_BY_REPOSITORY: '{"pypi": {"username": "${{ secrets.PYPI_USERNAME }}", "password": "${{ secrets.PYPI_PASSWORD }}"}}'
         run: |
           # TODO: make sure git tag exists (for manual trigger)
-          source .venvs/dev_workspace/bin/activate
+          source .venvs/dev_workspace/${{ matrix.venv_bin }}/activate
           python -m finecode run \
             --map-payload-fields="src-artifact-def-path,dist-artifact-paths" \
             publish_and_verify_artifact \
@@ -115,7 +155,7 @@ jobs:
 
       # TODO: try to replace by finecode action
       - name: Store the distribution packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         if: runner.os == 'Linux'
         with:
           name: python-package-distributions

scripts/setup-dev-workspace.sh

@@ -0,0 +1,56 @@
+#!/bin/sh
+# Creates (or validates) the dev_workspace venv with all monorepo packages installed
+# editable from local source. Shared by the devcontainer and CI so the two setup paths
+# cannot drift apart — see docs/guides/developing-finecode.md#continuous-integration.
+#
+# Must be run from the repo root.
+set -eu
+
+VENV_DIR=".venvs/dev_workspace"
+
+# venv layout differs on Windows (python.exe under Scripts/, not bin/); this script also
+# runs under Git Bash on GitHub Actions' windows-* runners, where `uname -s` reports
+# MINGW/MSYS/CYGWIN rather than a POSIX name.
+case "$(uname -s)" in
+    MINGW* | MSYS* | CYGWIN*) VENV_PYTHON="$VENV_DIR/Scripts/python.exe" ;;
+    *) VENV_PYTHON="$VENV_DIR/bin/python" ;;
+esac
+
+is_valid_venv() {
+    if [ ! -x "$VENV_PYTHON" ]; then
+        return 1
+    fi
+
+    # Requested check first; fall back to a guaranteed CLI entrypoint check.
+    if "$VENV_PYTHON" -m finecode version >/dev/null 2>&1; then
+        return 0
+    fi
+
+    if "$VENV_PYTHON" -m finecode version >/dev/null 2>&1; then
+        return 0
+    fi
+
+    "$VENV_PYTHON" -m finecode --help >/dev/null 2>&1
+}
+
+recreate_venv() {
+    rm -rf "$VENV_DIR"
+    python -m venv "$VENV_DIR"
+
+    # Ensure expected uv version is present in pipx-managed tools.
+    pipx install --force "uv==0.11.*"
+
+    # bootstrap cannot be used here because finecode has to be installed from local sources.
+    # The editable package list is generated (not hand-maintained) so it can't go stale —
+    # see list_dev_workspace_editables.py and docs/guides/developing-finecode.md#continuous-integration.
+    EDITABLE_ARGS=$(python scripts/list_dev_workspace_editables.py)
+    uv pip install --python "$VENV_PYTHON" --group dev_workspace $EDITABLE_ARGS -e .
+
+    "$VENV_PYTHON" -m finecode prepare-envs
+}
+
+if [ -d "$VENV_DIR" ] && is_valid_venv; then
+    echo "dev_workspace venv is valid; skipping recreation."
+else
+    recreate_venv
+fi