perf(ci): reuse verified artifacts and parallelize acceptance

.github/workflows/ci-desktop.yml

@@ -6,7 +6,9 @@ on:
       source_sha: {type: string, required: true}
       runner: {type: string, required: true}
       target: {type: string, required: true}
-      package_artifact: {type: string, default: ''}
+      package_artifact_id: {type: string, default: ''}
+      crypto_artifact_id: {type: string, default: ''}
+      web_artifact_id: {type: string, default: ''}
 permissions:
   contents: read
 jobs:
@@ -25,25 +27,39 @@ jobs:
         with: {node-version: '24', cache: pnpm, cache-dependency-path: pnpm-lock.yaml}
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with: {python-version: '3.12'}
+      - name: Require exact producer artifact IDs
+        env:
+          PACKAGE_ARTIFACT_ID: ${{ inputs.package_artifact_id }}
+          CRYPTO_ARTIFACT_ID: ${{ inputs.crypto_artifact_id }}
+          WEB_ARTIFACT_ID: ${{ inputs.web_artifact_id }}
+        run: |
+          if [[ -n "$PACKAGE_ARTIFACT_ID" ]]; then
+            [[ "$PACKAGE_ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]
+          else
+            [[ "$CRYPTO_ARTIFACT_ID" =~ ^[1-9][0-9]*$ && "$WEB_ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]
+          fi
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
-        if: inputs.package_artifact != ''
+        if: inputs.package_artifact_id != ''
         with:
-          name: ${{ inputs.package_artifact }}
+          artifact-ids: ${{ inputs.package_artifact_id }}
+          merge-multiple: true
           path: .artifacts/packages
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
-        if: inputs.package_artifact == ''
+        if: inputs.package_artifact_id == ''
         with:
-          name: crypto-web-${{ inputs.source_sha }}
+          artifact-ids: ${{ inputs.crypto_artifact_id }}
+          merge-multiple: true
           path: apps/app/generated
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
-        if: inputs.package_artifact == ''
+        if: inputs.package_artifact_id == ''
         with:
-          name: web-${{ inputs.source_sha }}
+          artifact-ids: ${{ inputs.web_artifact_id }}
+          merge-multiple: true
           path: apps/app/dist/client
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec
-        if: inputs.package_artifact == ''
+        if: inputs.package_artifact_id == ''
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0
-        if: inputs.package_artifact == ''
+        if: inputs.package_artifact_id == ''
         with:
           key: desktop-native-${{ inputs.target }}${{ runner.os == 'Windows' && '-static-crt' || '' }}
           cache-on-failure: true
@@ -53,7 +69,7 @@ jobs:
       - name: Select this platform's Python
         run: printf 'PY=%s\n' "$(command -v python3 || command -v python)" >> "$GITHUB_ENV"
       - name: Build this platform's native runtime
-        if: inputs.package_artifact == ''
+        if: inputs.package_artifact_id == ''
         env:
           TARGET: ${{ inputs.target }}
         run: |
@@ -64,7 +80,7 @@ jobs:
             bash scripts/package-node.sh --target "$TARGET"
           fi
       - name: Keep this platform's runtime independently reviewable
-        if: inputs.package_artifact == ''
+        if: inputs.package_artifact_id == ''
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: desktop-runtime-${{ inputs.target }}-${{ inputs.source_sha }}

.github/workflows/ci-native.yml

@@ -0,0 +1,41 @@
+name: ci-native
+on:
+  workflow_call:
+    inputs:
+      runner: {type: string, required: true}
+      target: {type: string, required: true}
+    outputs:
+      artifact_id:
+        value: ${{ jobs.build.outputs.artifact_id }}
+      producer_attempt:
+        value: ${{ jobs.build.outputs.producer_attempt }}
+permissions:
+  contents: read
+jobs:
+  build:
+    runs-on: ${{ inputs.runner }}
+    outputs:
+      artifact_id: ${{ steps.upload.outputs.artifact-id }}
+      producer_attempt: ${{ github.run_attempt }}
+    env:
+      PACKAGE_TARGET: ${{ inputs.target }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0
+        with:
+          shared-key: package-${{ inputs.target }}-package
+          save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch' }}
+      - name: Build and seal native release input without Web dependencies
+        run: |
+          [[ "$(rustc -vV | sed -n 's/^host: //p')" == "$PACKAGE_TARGET" ]]
+          bash scripts/package-node.sh --target "$PACKAGE_TARGET" --native-output .artifacts/native-input.tar.gz
+      - id: upload
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: native-${{ inputs.target }}-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/native-input.tar.gz
+          if-no-files-found: error
+          retention-days: 14