ci: shorten checks and release critical path

[barryollama]

Summary

• add targeted Rust/npm/tool caching to the critical CI jobs, cancel superseded PR runs, and skip duplicate full CI for release-marker-only commits
• overlap plugin packaging and full core registry verification with publication; publish the two optional plugin families in parallel while retaining pre-publish compatibility gates and required post-publish verification
• bound npm registry metadata checks to four concurrent requests and add workflow-graph regression tests

Expected impact

Recent CI spent about 8 minutes in the uncached verify job and 5 minutes in optional plugin checks. Release runs also serialized roughly 1m45s of plugin packaging plus the full core registry smoke before plugin publication. This change targets those measured critical paths without removing release coverage.

Validation

• actionlint .github/workflows/*.yml
• node --test scripts/*.test.mjs (96 tests)
• cargo fmt --all -- --check
• git diff --check

---

Note

Medium Risk
Release ordering and job dependencies changed (tag before full smoke, GitHub Release after verification); mistakes could affect recovery via skip_core or when downstream publishes run, though regression tests document the intended graph.

Overview
Speeds up CI and the release pipeline without dropping the same gates, mainly by caching, canceling stale runs, overlapping work, and splitting publish into verify/finalize steps.

CI skips the full suite on .release/dispatch-patch-* marker commits, cancels superseded PR runs, and adds dedicated Rust/npm caches (including pinned cargo-public-api 0.52.0) on verify and optional-history-plugins.

Release (publish.yml) pushes the git tag right after a registry visibility wait; full core smoke (clean-install + older glibc CLI) runs in new verify-core, and GitHub Release creation moves to finalize-core only after that passes. Plugin tarballs build in package-plugins in parallel with core publish; two plugin families publish via a matrix job, with registry proof in verify-plugins. Crates.io, probe assets, and version persist wait on verified/finalized core.

Scripts: plugin registry polling uses bounded concurrent npm view (default 4) with async I/O; workflow-performance.test.mjs locks in the intended workflow graph.

^{Reviewed by Cursor Bugbot for commit b071b58. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b14c4cda-8b6f-4843-9c0b-a4efc36b3d39

📥 Commits

Reviewing files that changed from the base of the PR and between 1d7a69d and b071b58.

📒 Files selected for processing (2)

• .github/workflows/publish.yml
• scripts/workflow-performance.test.mjs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b4fee197-7328-4863-8da1-7e0be4ac498f

📥 Commits

Reviewing files that changed from the base of the PR and between 5e2389d and 1d7a69d.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .github/workflows/publish.yml
• scripts/verify-published-plugins.mjs
• scripts/verify-published-plugins.test.mjs
• scripts/workflow-performance.test.mjs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The CI workflow adds run cancellation and cache configuration. The publish workflow separates core and plugin packaging, publication, and registry verification. The plugin registry checker now performs asynchronous lookups in bounded batches, with tests covering concurrency and workflow structure.

Changes

CI and release workflows

Layer / File(s)	Summary
CI run controls and caches .github/workflows/ci.yml, scripts/workflow-performance.test.mjs	CI ignores release-marker-only pushes and cancels earlier runs in the same group. The verify and optional-history-plugins jobs add Rust and npm caches. The public API job caches cargo-public-api version 0.52.0 and installs it on a cache miss. Tests check the workflow settings.
Core publication and verification .github/workflows/publish.yml, scripts/workflow-performance.test.mjs	Core publication waits for registry visibility. A separate verify-core job runs the clean-install and older-glibc smoke tests after publication. Workflow tests check the job dependencies and steps.
Plugin packaging and publication .github/workflows/publish.yml, scripts/workflow-performance.test.mjs	package-plugins stamps package versions and uploads plugin tarballs as an artifact. Per-plugin jobs check compatibility and publish the matching helper and main tarballs. Workflow tests check packaging dependencies, artifact naming, and publication configuration.
Plugin registry verification .github/workflows/publish.yml, scripts/verify-published-plugins.mjs, scripts/verify-published-plugins.test.mjs, scripts/workflow-performance.test.mjs	verify-plugins checks published packages separately. The checker performs asynchronous lookups in batches, defaults to concurrency 4, cleans up temporary caches, and retains retries for registry visibility failures. Tests check concurrency and fatal-error call counts.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant Package as package-plugins
  participant Publish as per-plugin publication
  participant Registry as npm registry
  participant Verify as verify-plugins
  Package->>Publish: provide plugin-packages artifact
  Publish->>Registry: publish plugin and helper tarballs
  Verify->>Registry: check published plugin installation

Loading

Suggested reviewers: willwashburn

Merge Risk: ⚪ Minimal · up to 1d7a6

No identified issue blocks merging after the normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 1d7a6

Release checks still run, but a successful core publication can now trigger plugin publication and creation of a release before the published core passes its full installation and runtime checks. A later failure cannot undo packages already published.

Retained concerns

• Medium · reliability · observed: Full published-core installation and runtime checks no longer gate plugin publication or creation of the GitHub Release. If those checks fail, the workflow can have already published additional packages and recorded the release, leaving a partial or defective release to recover manually.

Security review details

Security Blast Radius

• inferred — If published-core checks fail after the visibility gate, the affected release state can extend beyond core npm packages to both optional plugin families and the recorded GitHub Release. Publication is externally visible and is not undone by a failing verification job.

Trust Boundaries and Controls

• observed — The release is workflow-dispatched, keeps build and packaging jobs read-only, and grants OIDC authority to plugin publishing rows. Each row checks core compatibility and rejects obsolete plugin names on a plugin-only retry before publishing.
• observed — The moved core check runs in a read-only job; its public-registry install path removes npm authentication variables before installing the published packages.

Resilience and Maintainability Implications

• observed — Registry lookup failures other than recognized visibility errors, invalid manifests, and wrong versions still fail verification rather than being accepted by the new concurrent lookup path.

Hardening Proposals

• proposed — Either make successful published-core smoke verification a prerequisite for further irreversible publication, or define an explicit recovery procedure for a failed verify-core job after downstream publication has begun.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main changes: shortening CI checks and reducing the release critical path.
Description check	✅ Passed	The description directly explains the CI caching, workflow parallelization, bounded registry checks, expected impact, and validation for this changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the cache at dawn
Then packs the plugins, one by one
The registry replies, in bounded queues
Smoke tests hop through their separate route
The workflow settles; carrots for all}

_{Comment @coderabbitai help to get the list of available commands.}