ci: run jobs in parallel

.github/workflows/_build-rs.yml

@@ -63,6 +63,25 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+      # Both are I/O bound and independent of the toolchain setup below, so
+      # overlap them with it; `wait-all` joins them before the build.
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
+        background: true
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            cache/
+          key: target-cache-${{ matrix.platform }}-${{ hashFiles('**/Cargo.lock') }}-${{ matrix.target }}
+          restore-keys: |
+            target-cache-${{ matrix.platform }}-${{ hashFiles('**/Cargo.lock') }}-
+            target-cache-${{ matrix.platform }}-
+      # Only rust-toolchain.toml is read from the build context, so the cache
+      # restore writing into cache/ concurrently is harmless.
+      - name: Build builder image
+        if: startsWith(matrix.platform, 'ubuntu')
+        background: true
+        run: make containers/builder/build
       - if: ${{ matrix.target == 'ak-agent-desktop' }}
         uses: pnpm/action-setup@v6.1.0
         with:
@@ -99,19 +118,7 @@ jobs:
             ~/.rustup/toolchains
             ~/.rustup/update-hashes
           key: rustup-toolchain-${{ matrix.platform }}-${{ hashFiles('rust-toolchain.toml') }}
-      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            cache/
-          key: target-cache-${{ matrix.platform }}-${{ hashFiles('**/Cargo.lock') }}-${{ matrix.target }}
-          restore-keys: |
-            target-cache-${{ matrix.platform }}-${{ hashFiles('**/Cargo.lock') }}-
-            target-cache-${{ matrix.platform }}-
-      - name: Build builder image
-        if: startsWith(matrix.platform, 'ubuntu')
-        run: make containers/builder/build
+      - wait-all:
       - run: |
           make ${{ matrix.target }}/build
         env:

.github/workflows/_deploy.yml

@@ -17,11 +17,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          path: ./bin
-      - run: |
-          sudo apt-get remove --purge man-db
+      - parallel:
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              path: ./bin
+          - run: |
+              sudo apt-get remove --purge man-db
       - uses: ./.github/actions/repo
         id: repo
         with:

.github/workflows/_package-darwin.yml

@@ -16,26 +16,27 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_macos-26_ak-agent-desktop
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_macos-26_ak-cli
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_macos-26_ak-sysd
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_macos-26_ak-browser-support
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_xcode-27_psso
-          path: bin/
+      - parallel:
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_macos-26_ak-agent-desktop
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_macos-26_ak-cli
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_macos-26_ak-sysd
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_macos-26_ak-browser-support
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_xcode-27_psso
+              path: bin/
 
       - id: check
         env:

.github/workflows/_package-linux.yml

@@ -26,38 +26,39 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_${{ matrix.platform }}_ak-cli${{ inputs.artifact_suffix }}
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_${{ matrix.platform }}_ak-agent${{ inputs.artifact_suffix }}
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_${{ matrix.platform }}_ak-agent-desktop${{ inputs.artifact_suffix }}
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_${{ matrix.platform }}_ak-sysd${{ inputs.artifact_suffix }}
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_${{ matrix.platform }}_ak-browser-support${{ inputs.artifact_suffix }}
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_${{ matrix.platform }}_ak-nss${{ inputs.artifact_suffix }}
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_${{ matrix.platform }}_ak-pam${{ inputs.artifact_suffix }}
-          path: bin/
-      - run: |
-          echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
-          sudo apt update
-          sudo apt install nfpm -y
+      - parallel:
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_${{ matrix.platform }}_ak-cli${{ inputs.artifact_suffix }}
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_${{ matrix.platform }}_ak-agent${{ inputs.artifact_suffix }}
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_${{ matrix.platform }}_ak-agent-desktop${{ inputs.artifact_suffix }}
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_${{ matrix.platform }}_ak-sysd${{ inputs.artifact_suffix }}
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_${{ matrix.platform }}_ak-browser-support${{ inputs.artifact_suffix }}
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_${{ matrix.platform }}_ak-nss${{ inputs.artifact_suffix }}
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_${{ matrix.platform }}_ak-pam${{ inputs.artifact_suffix }}
+              path: bin/
+          - run: |
+              echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
+              sudo apt update
+              sudo apt install nfpm -y
       - shell: bash
         run: make vpkg/linux/package
         env:

.github/workflows/_package-windows.yml

@@ -16,28 +16,28 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_windows-2025_ak-agent-desktop
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_windows-2025_ak-cli
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_windows-2025_ak-sysd
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_windows-2025_ak-browser-support
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_windows-2025_ee-wcp
-          path: bin/
-
-      - uses: digicert/code-signing-software-trust-action@v1
+      - parallel:
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_windows-2025_ak-agent-desktop
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_windows-2025_ak-cli
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_windows-2025_ak-sysd
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_windows-2025_ak-browser-support
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_windows-2025_ee-wcp
+              path: bin/
+          - uses: digicert/code-signing-software-trust-action@v1
       - shell: bash
         run: |
           echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12

.github/workflows/release-publish.yml

@@ -180,6 +180,7 @@ jobs:
         with:
           product: platform
           new-version: ${{ steps.get-version.outputs.version }}
+          changelog-url: ${{ github.event.release.html_url }}
           reason: bugfix
           token: ${{ steps.app-token.outputs.token }}
           github-app-slug: ${{ steps.app-token.outputs.app-slug }}

.github/workflows/test.yml

@@ -59,16 +59,19 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
-        with:
-          rustflags: ""
-          build-warnings: warn
+      - parallel:
+          - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
+            with:
+              rustflags: ""
+              build-warnings: warn
+          - uses: ./.github/actions/setup-toolchain
+            with:
+              platform: ${{ matrix.platform }}
+      # install-action writes ~/.cargo/bin, which the toolchain's rust-cache
+      # snapshots and restores, so it must not overlap with it.
       - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2
         with:
           tool: cargo-llvm-cov nextest
-      - uses: ./.github/actions/setup-toolchain
-        with:
-          platform: ${{ matrix.platform }}
       - run: |
           make ${{ matrix.target }}/test
         env:
@@ -136,11 +139,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
-        with:
-          rustflags: ""
-          build-warnings: warn
-      - run: make ci-install-deps
+      - parallel:
+          - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
+            with:
+              rustflags: ""
+              build-warnings: warn
+          - run: make ci-install-deps
       - uses: ./.github/actions/setup-toolchain
         with:
           platform: ${{ matrix.platform }}
@@ -197,50 +201,54 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
-        with:
-          rustflags: ""
-          build-warnings: warn
+      - parallel:
+          - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
+            with:
+              rustflags: ""
+              build-warnings: warn
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_package-linux-ubuntu-26.04-e2e
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_ubuntu-26.04_ak-agent-e2e
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_ubuntu-26.04_ak-cli-e2e
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_ubuntu-26.04_ak-nss-e2e
+              path: bin/
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
+            with:
+              name: authentik_ubuntu-26.04_ak-pam-e2e
+              path: bin/
+      # see test_rs: must not overlap with setup-rust-toolchain
       - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2
         with:
           tool: cargo-llvm-cov nextest
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_package-linux-ubuntu-26.04-e2e
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_ubuntu-26.04_ak-agent-e2e
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_ubuntu-26.04_ak-cli-e2e
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_ubuntu-26.04_ak-nss-e2e
-          path: bin/
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
-        with:
-          name: authentik_ubuntu-26.04_ak-pam-e2e
-          path: bin/
       - run: chmod +x bin/agent/ak-agent bin/cli/ak bin/sysd/ak-sysd
-      - uses: goauthentik/action-setup-authentik@5b35e5951a1ec761847711a5d8170dbd67675526 # v3.3
-        id: setup
-        with:
-          version: beta
-          sentry_env: goauthentik-platform-ci
-          blueprints_path: ./hack/authentik/blueprints
-          wait: true
-          enterprise_license: true
-          enterprise_license_users_internal: 100
-          enterprise_license_users_external: 100
+      # authentik startup and the e2e image build are independent; overlap them.
+      - parallel:
+          - uses: goauthentik/action-setup-authentik@5b35e5951a1ec761847711a5d8170dbd67675526 # v3.3
+            id: setup
+            with:
+              version: beta
+              sentry_env: goauthentik-platform-ci
+              blueprints_path: ./hack/authentik/blueprints
+              wait: true
+              enterprise_license: true
+              enterprise_license_users_internal: 100
+              enterprise_license_users_external: 100
+          - run: make containers/e2e/ci-build
       - env:
           AK_TOKEN: ${{ steps.setup.outputs.admin_token }}
           AK_URL: ${{ steps.setup.outputs.http_url }}
         run: |
           ./hack/authentik/wait.sh
-      - run: make containers/e2e/ci-build
       # AppArmor policy is host-global: and the container cannot load policy of
       # its own (no securityfs during docker build)
       - name: Load authentik AppArmor drop-in