refactor: complete shell decomposition and parallelize validation

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
       - README.md
       - CHANGELOG.md
       - docs/**
+      - .planning/**
       - .github/**/*.md
   push:
     branches:
@@ -15,6 +16,7 @@ on:
       - README.md
       - CHANGELOG.md
       - docs/**
+      - .planning/**
       - .github/**/*.md
   workflow_dispatch:
 
@@ -31,55 +33,60 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  verify:
-    name: make verify
+  decision:
+    name: CI decision
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 10
+    outputs:
+      run_full: ${{ steps.dedupe.outputs.run_full }}
 
     steps:
       - name: Deduplicate an already verified main tree
         id: dedupe
-        if: github.event_name == 'push'
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -uo pipefail
           run_full=true
-          reason="no exact successful pull request validation was found"
-
-          if ! pulls=$(gh api \
-            -H "Accept: application/vnd.github+json" \
-            "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls?per_page=100"); then
-            echo "::warning::Could not resolve associated pull requests; running full CI."
-          else
-            pr=$(jq -c --arg sha "$GITHUB_SHA" \
-              '[.[] | select(.merged_at != null and .merge_commit_sha == $sha)] | sort_by(.number) | last // empty' \
-              <<<"$pulls")
-
-            if [ -n "$pr" ]; then
-              pr_number=$(jq -r .number <<<"$pr")
-              head_sha=$(jq -r .head.sha <<<"$pr")
-
-              if push_tree=$(gh api "repos/$GITHUB_REPOSITORY/git/commits/$GITHUB_SHA" --jq .tree.sha) \
-                && head_tree=$(gh api "repos/$GITHUB_REPOSITORY/git/commits/$head_sha" --jq .tree.sha) \
-                && runs=$(gh api \
-                  "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?event=pull_request&head_sha=$head_sha&status=completed&per_page=20"); then
-                expected_title="CI PR #$pr_number"
-                latest_conclusion=$(jq -r --arg title "$expected_title" \
-                  '[.workflow_runs[] | select(.display_title == $title)] | sort_by(.run_started_at) | last | .conclusion // ""' \
-                  <<<"$runs")
-
-                if [ "$push_tree" = "$head_tree" ] && [ "$latest_conclusion" = "success" ]; then
-                  run_full=false
-                  reason="PR #$pr_number successfully validated the exact tree $push_tree"
-                elif [ "$push_tree" != "$head_tree" ]; then
-                  reason="the merged tree differs from PR #$pr_number head"
+          reason="this event requires full validation"
+
+          if [ "$GITHUB_EVENT_NAME" = "push" ]; then
+            reason="no exact successful pull request validation was found"
+
+            if ! pulls=$(gh api \
+              -H "Accept: application/vnd.github+json" \
+              "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls?per_page=100"); then
+              echo "::warning::Could not resolve associated pull requests; running full CI."
+            else
+              pr=$(jq -c --arg sha "$GITHUB_SHA" \
+                '[.[] | select(.merged_at != null and .merge_commit_sha == $sha)] | sort_by(.number) | last // empty' \
+                <<<"$pulls")
+
+              if [ -n "$pr" ]; then
+                pr_number=$(jq -r .number <<<"$pr")
+                head_sha=$(jq -r .head.sha <<<"$pr")
+
+                if push_tree=$(gh api "repos/$GITHUB_REPOSITORY/git/commits/$GITHUB_SHA" --jq .tree.sha) \
+                  && head_tree=$(gh api "repos/$GITHUB_REPOSITORY/git/commits/$head_sha" --jq .tree.sha) \
+                  && runs=$(gh api \
+                    "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?event=pull_request&head_sha=$head_sha&status=completed&per_page=20"); then
+                  expected_title="CI PR #$pr_number"
+                  latest_conclusion=$(jq -r --arg title "$expected_title" \
+                    '[.workflow_runs[] | select(.display_title == $title)] | sort_by(.run_started_at) | last | .conclusion // ""' \
+                    <<<"$runs")
+
+                  if [ "$push_tree" = "$head_tree" ] && [ "$latest_conclusion" = "success" ]; then
+                    run_full=false
+                    reason="PR #$pr_number successfully validated the exact tree $push_tree"
+                  elif [ "$push_tree" != "$head_tree" ]; then
+                    reason="the merged tree differs from PR #$pr_number head"
+                  else
+                    reason="the latest CI run for PR #$pr_number is not successful"
+                  fi
                 else
-                  reason="the latest CI run for PR #$pr_number is not successful"
+                  echo "::warning::Could not verify the associated PR tree and run; running full CI."
                 fi
-              else
-                echo "::warning::Could not verify the associated PR tree and run; running full CI."
               fi
             fi
           fi
@@ -91,13 +98,19 @@ jobs:
             echo "$reason. Expensive validation is skipped for this main push." >> "$GITHUB_STEP_SUMMARY"
           fi
 
+  verify:
+    name: make verify
+    needs: decision
+    if: needs.decision.outputs.run_full == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+
+    steps:
       - name: Checkout
-        if: steps.dedupe.outputs.run_full != 'false'
         uses: actions/checkout@v5
 
       - name: Check patch and detect a release version change
         id: changes
-        if: steps.dedupe.outputs.run_full != 'false'
         shell: bash
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -124,31 +137,26 @@ jobs:
           fi
 
       - name: Setup pnpm
-        if: steps.dedupe.outputs.run_full != 'false'
         uses: pnpm/action-setup@v6
         with:
           version: 9.15.0
 
       - name: Setup Node
-        if: steps.dedupe.outputs.run_full != 'false'
         uses: actions/setup-node@v5
         with:
           node-version: 22.22.3
           cache: pnpm
 
       - name: Setup Rust
-        if: steps.dedupe.outputs.run_full != 'false'
         uses: dtolnay/rust-toolchain@stable
 
       - name: Cache Rust build
-        if: steps.dedupe.outputs.run_full != 'false'
         uses: Swatinem/rust-cache@v2
         with:
           workspaces: src-tauri -> target
-          key: ci-ubuntu-22.04
+          shared-key: ubuntu-22.04-validation
 
       - name: Install Linux Tauri dependencies
-        if: steps.dedupe.outputs.run_full != 'false'
         run: |
           sudo apt-get update
           sudo apt-get install -y \
@@ -159,29 +167,51 @@ jobs:
             librsvg2-dev
 
       - name: Install frontend dependencies
-        if: steps.dedupe.outputs.run_full != 'false'
         run: pnpm install --frozen-lockfile
 
       - name: Run verify (typecheck + version checks + guards + tests + frontend build)
-        if: steps.dedupe.outputs.run_full != 'false' && steps.changes.outputs.release != 'true'
+        if: steps.changes.outputs.release != 'true'
         run: make verify
 
       - name: Run verify and release-only checks
-        if: steps.dedupe.outputs.run_full != 'false' && steps.changes.outputs.release == 'true'
+        if: steps.changes.outputs.release == 'true'
         run: make release-checks
 
+  e2e:
+    name: playwright e2e
+    needs: decision
+    if: needs.decision.outputs.run_full == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 9.15.0
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22.22.3
+          cache: pnpm
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
       # e2e used to run only in release-preflight, so a broken or flaky spec
       # first surfaced on the release tag instead of on the PR that caused it.
       - name: Install Playwright browsers
-        if: steps.dedupe.outputs.run_full != 'false'
         run: pnpm exec playwright install --with-deps chromium
 
       - name: Run e2e
-        if: steps.dedupe.outputs.run_full != 'false'
         run: make test-e2e
 
       - name: Upload e2e artifacts on failure
-        if: steps.dedupe.outputs.run_full != 'false' && failure()
+        if: failure()
         uses: actions/upload-artifact@v4
         with:
           name: playwright-report

.github/workflows/release-bundles.yml

@@ -169,13 +169,14 @@ jobs:
 
       # rust-toolchain.toml pins the channel (GATE-05), so cargo resolves to the
       # pinned toolchain rather than the stable one the action installed. Adding
-      # targets through the action's `targets:` input adds them to stable, which
-      # the build never uses - the v0.4.63 macOS Intel job failed on exactly that
-      # ("Target x86_64-apple-darwin is not installed"). Run rustup from the repo
-      # so it resolves the pinned toolchain and installs the targets there.
-      - name: Add macOS cross targets to the pinned toolchain
+      # a target through the action's `targets:` input adds it to stable, which
+      # the build never uses. Run rustup from the repo so each macOS matrix leg
+      # installs only its own target into the pinned toolchain.
+      - name: Add macOS target to the pinned toolchain
         if: matrix.platform == 'macos-latest'
-        run: rustup target add aarch64-apple-darwin x86_64-apple-darwin
+        env:
+          TARGET: ${{ matrix.cli_target }}
+        run: rustup target add "$TARGET"
 
       - name: Cache Rust build
         uses: Swatinem/rust-cache@v2

.github/workflows/release-preflight.yml

@@ -14,10 +14,10 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  release-preflight:
-    name: make release-preflight
+  release-preflight-core:
+    name: make release-preflight-core
     runs-on: ubuntu-22.04
-    timeout-minutes: 90
+    timeout-minutes: 60
 
     steps:
       - name: Checkout
@@ -41,7 +41,7 @@ jobs:
         uses: Swatinem/rust-cache@v2
         with:
           workspaces: src-tauri -> target
-          key: release-preflight-ubuntu-22.04
+          shared-key: ubuntu-22.04-validation
 
       - name: Install Linux Tauri dependencies
         run: |
@@ -51,15 +51,93 @@ jobs:
             libxdo-dev \
             libssl-dev \
             libayatana-appindicator3-dev \
-            librsvg2-dev \
-            patchelf \
-            rpm
+            librsvg2-dev
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run release preflight core
+        run: make release-preflight-core
+
+  cli-smoke:
+    name: make cli-smoke
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 9.15.0
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22.22.3
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
+          shared-key: ubuntu-22.04-release-cli
+
+      - name: Install Linux Tauri dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libxdo-dev \
+            libssl-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run release CLI smoke
+        run: make cli-smoke
+
+  e2e:
+    name: playwright e2e
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 9.15.0
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22.22.3
+          cache: pnpm
 
       - name: Install frontend dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Install Playwright browser
         run: pnpm exec playwright install --with-deps chromium
 
-      - name: Run release preflight
-        run: make release-preflight
+      - name: Run e2e
+        run: make test-e2e
+
+      - name: Upload e2e artifacts on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: |
+            playwright-report/
+            test-results/
+          retention-days: 7