Repository navigation
ci: cargo-audit is downloaded, not compiled; the iOS job reuses its pinned native inputs; CLAUDE.md - #73
Merged
Conversation
jamesyong-42
pushed a commit
that referenced
this pull request
Oct 25, 2026
…s of its three Apple targets — build:apple-native stops compiling them from scratch - build:apple-native runs `cargo build --release -p ghosttea-apple-ffi` for aarch64-apple-darwin, aarch64-apple-ios and aarch64-apple-ios-sim. It took 152 s on PR #73 (run 40156639614) and 133-163 s on earlier runs, nearly all of it compiling the same dependency graph three times. - Swatinem/rust-cache@v2 after the 1.97.1 toolchain step, with the desktop gates' policy: - only non-pull_request events save; - workspace crates are not cached; - ~/.cargo/bin stays out. - The publication build (build-candidate in ghosttea-apple-native-artifact.yml) is unchanged and still compiles everything from scratch. - Verified here: the workflow parses with the cache step after the toolchain. Cold and warm timings come from dispatched runs of this branch; see the PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ksum — the audit jobs stop compiling it - `cargo install cargo-audit --version 0.22.2 --locked` compiled the tool on every run: 106 s of dependency-audit's 128 s on PR #72 (run 40052723708), and 169 s of rust-audit's 188 s on v0.13.1 (run 39899120469). - Both jobs now download cargo-audit-x86_64-unknown-linux-musl-v0.22.2.tgz from rustsec/rustsec's cargo-audit/v0.22.2 release, check it against a pinned SHA-256 and install it into ~/.cargo/bin. The version stays 0.22.2, so `cargo audit` and .cargo/audit.toml behave as before. - The pinned hash, 7fb9497f…c428, is the sha256 of the served asset. It equals the hash that taiki-e/install-action's manifest records for the same file. The musl build is static, so it does not depend on the runner's glibc. - publish-release's rust-audit only runs on tags. dependency-audit runs the identical step on ubuntu-24.04 in this PR. - Verified here: the asset's sha256 and its archive layout (`cargo-audit-…-v0.22.2/cargo-audit`); both workflows parse and keep their step order. Not run here: prettier (no Node on this machine). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ed while their inputs are unchanged — validate-package-manifests skips about seven minutes - validate-package-manifests rebuilt both native inputs from source on every run: build:ghostty-vt:apple took 177 s and build:ssh:apple 248 s of the job's 762 s on PR #72 (run 40052723838). - The cache key hashes everything those builds depend on: - ghostty.lock.json, native/patches, ssh.lock.json and ios-toolchain.lock.json; - the six bootstrap, build and validate scripts, plus ghostty-vt-target.mjs, their only local import; - the runner architecture; - `xcodebuild -version` and the macOS, iOS and simulator SDK versions of both DEVELOPER_DIR (26.6) and GHOSTTY_DEVELOPER_DIR (26.3). - A runner image that moves an Xcode build or SDK therefore misses and rebuilds. The rebuild is where build-ghostty-vt-apple.mjs checks the toolchain against ghostty.lock.json's appleBuilder. - A hit can only restore outputs that a successful run built from identical inputs, because actions/cache saves on success only. - The cache holds only what build:apple-native reads and the job uploads: the two xcframeworks in apple/GhostteaKit/Artifacts and the two build-metadata.json files. Zig's cache directories and the OpenSSL build tree stay out. - The bootstraps still run on a hit, because build-ghosttea-apple-native.mjs runs sync-ghosttea-fonts.mjs, which needs native/vendor/ghostty at the locked commit. - Unchanged: the publication build (build-candidate in ghosttea-apple-native-artifact.yml) and publish-release never use this cache. - Verified here: the step order and conditions parse as intended, and grep finds the consumers of each cached path. This PR's first run misses and saves; a re-run of the job exercises a hit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…variants and the release flow - Commands as package.json and the workflows run them, including the local prerequisite ci:desktop needs (bootstrap:ghostty-vt for the font sync) and how to run one Rust, TypeScript, Node or Swift test. - The desktop frame path, the two local planes, and what each crate and package owns. - Invariants checked against the source: - protocol minors (service.rs constants and asserts) and TRF1's additive sections; - the stdout test and the input actor's weak session reference; - the vt-sys build-script guard and the renderer command allowlist; - the iOS inventory chain after a Cargo.lock change, and the Apple artifact's source digest. - The release outline from PUBLISHING.md and the release commits, with the `release` environment's current settings: no required reviewer since 2026-10-24, and `v*` tags admin-only through the "release tags" ruleset. It also notes auto-merge's limit: it waits only for the required verify and windows checks. - One process note: don't dispatch desktop-release-gates or ios-release-hardening by hand on a branch that has a PR. On PR #72 both ran twice, and the PR's verify waited 68 s for a macOS runner. - Not run here: prettier (no Node on this machine). The file follows its markdown rules by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jamesyong-42
force-pushed
the
ci/faster-checks
branch
from
October 25, 2026 05:08
5c69216 to
b99ca7d
Compare
jamesyong-42
added a commit
that referenced
this pull request
Oct 25, 2026
…dependencies — the required checks stop compiling the dependency graph from scratch - No job cached Rust builds. ci:desktop compiles the dependency graph cold several times per job: cargo check and clippy, cargo test, the FFI parity probe, and the release build for the soak. On PR #73, verify ran 832 s and windows 738 s, and those two bound every PR's wall-clock. - Swatinem/rust-cache@v2 now runs after each toolchain step. Its key is the job, OS, rustc and the lockfile. A moved lockfile restores the newest cache for the same job and rustc. Workspace crates are not cached and always rebuild, so what is tested is what is checked out. - save-if: only non-pull_request events save (a push to main, the weekly schedule, a dispatch). Pull requests read main's cache and never write their own, so the repository's cache holds one entry per job instead of one per PR. - cache-bin: false keeps ~/.cargo/bin out, so the toolchain that dtolnay/rust-toolchain installed is the one that runs. - Unchanged: - publish-release builds and tests with no cache, so a published binary never comes from one; - the iOS and Apple artifact workflows are untouched. - Verified here: the workflow parses, with the cache step after each toolchain step. Cold and warm timings come from dispatched runs of this branch; see the PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jamesyong-42
added a commit
that referenced
this pull request
Oct 25, 2026
…s of its three Apple targets — build:apple-native stops compiling them from scratch - build:apple-native runs `cargo build --release -p ghosttea-apple-ffi` for aarch64-apple-darwin, aarch64-apple-ios and aarch64-apple-ios-sim. It took 152 s on PR #73 (run 40156639614) and 133-163 s on earlier runs, nearly all of it compiling the same dependency graph three times. - Swatinem/rust-cache@v2 after the 1.97.1 toolchain step, with the desktop gates' policy: - only non-pull_request events save; - workspace crates are not cached; - ~/.cargo/bin stays out. - The publication build (build-candidate in ghosttea-apple-native-artifact.yml) is unchanged and still compiles everything from scratch. - Verified here: the workflow parses with the cache step after the toolchain. Cold and warm timings come from dispatched runs of this branch; see the PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three commits that cut runner time from the gates. Two process changes go with them; one landed through repo settings and one through CLAUDE.md.
What changes
ci(audit).dependency-auditand publish-release'srust-auditdownload RustSec's owncargo-audit0.22.2 build and check it against a pinned SHA-256, instead of compiling it withcargo install.cargo auditand.cargo/audit.tomlbehave as before.ci(ios).validate-package-manifestscaches the libghostty-vt and libssh2/OpenSSL outputs, then skipsbuild:ghostty-vt:apple(177 s) andbuild:ssh:apple(248 s) while their inputs are unchanged (run 40052723838).xcodebuild -versionand SDK versions. A runner-image toolchain change therefore rebuilds, and the rebuild runs the toolchain check inbuild-ghostty-vt-apple.mjs.build:apple-nativereads are cached.build-candidate) andpublish-releasenever use this cache.docs. A CLAUDE.md for Claude Code sessions covering commands, architecture, invariants checked against the source, and the release outline.verifywaited 68 s for a macOS runner.Repository settings changed on 2026-10-24, outside this diff
releaseenvironment no longer requires a reviewer. Onlyv*tags andrelease/*branches can deploy to it, and the environment stays because npm and crates.io trust it.v*tags to admins, so an admin's tag push stays the release gate. The org-wide Blacksmith app has write access and can no longer start a publish.verifyandwindows, so check the iOS and Apple artifact runs before tagging a release.What this does not change
verify(about 12.6 min) andwindows(about 11.5 min). This PR doesn't touch them; it saves runner minutes and macOS queueing.Checks
ci:desktop, because this Mac has no Node or Rust.verifyrunsformat:checkover the workflows and CLAUDE.md.dependency-auditexercises the new install step, and iOS hardening's first run misses the cache and saves it. A re-run ofvalidate-package-manifestsexercises a hit.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.