authorgravatar for me@t3.ggTheo Browne <me@t3.gg> 2026-09-03 03:13:15-07:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2026-09-03 03:13:15-07:00
logfff33f9e851912363c5b1f3ac65598be35eb5f0d
treeb8e876d03ee995256ae86d57ca5adc18d9ded0d5
parent1e051873094c0c75cd35fef89c90461c22cce76b
signature Signed by PGP key B5690EEEBB952194

perf(ci): reuse dependency checks in release builds (#9399)

2 files changed, 27 insertions(+), 0 deletions(-)

.github/workflows/release.yml+22
...@@ -111,6 +111,8 @@ jobs:...@@ -111,6 +111,8 @@ jobs:
111 node-version-file: package.json111 node-version-file: package.json
112 cache: true112 cache: true
113 run-install: true113 run-install: true
114 env:
115 pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
114116
115 - id: release_meta117 - id: release_meta
116 name: Resolve release version118 name: Resolve release version
...@@ -174,6 +176,14 @@ jobs:...@@ -174,6 +176,14 @@ jobs:
174 --current-tag "${{ steps.release_meta.outputs.tag }}" \176 --current-tag "${{ steps.release_meta.outputs.tag }}" \
175 --github-output177 --github-output
176178
179 # Share only the verification results, not the large registry metadata cache.
180 - name: Upload dependency verification
181 continue-on-error: true
182 uses: actions/upload-artifact@v7
183 with:
184 name: release-dependency-verification
185 path: ${{ runner.temp }}/pnpm-metadata/lockfile-verified.jsonl
186
177 quality:187 quality:
178 name: Release quality checks188 name: Release quality checks
179 needs: [preflight]189 needs: [preflight]
...@@ -446,7 +456,18 @@ jobs:...@@ -446,7 +456,18 @@ jobs:
446 path: ${{ steps.package_cache_path.outputs.path }}456 path: ${{ steps.package_cache_path.outputs.path }}
447 key: windows-release-packages-v1-${{ matrix.arch }}-${{ hashFiles('pnpm-lock.yaml') }}457 key: windows-release-packages-v1-${{ matrix.arch }}-${{ hashFiles('pnpm-lock.yaml') }}
448458
459 # pnpm checks the lockfile and policy before reusing this result. A missing
460 # artifact leaves the cache empty, so installation runs the checks again.
461 - name: Download dependency verification
462 continue-on-error: true
463 uses: actions/download-artifact@v8
464 with:
465 name: release-dependency-verification
466 path: ${{ runner.temp }}/pnpm-metadata
467
449 - name: Install desktop dependencies468 - name: Install desktop dependencies
469 env:
470 pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
450 run: vp install --filter=@t3tools/desktop... --filter=t3... --filter=@t3tools/scripts...471 run: vp install --filter=@t3tools/desktop... --filter=t3... --filter=@t3tools/scripts...
451472
452 - name: Cache resource monitor473 - name: Cache resource monitor
...@@ -583,6 +604,7 @@ jobs:...@@ -583,6 +604,7 @@ jobs:
583 - name: Build desktop artifact604 - name: Build desktop artifact
584 shell: bash605 shell: bash
585 env:606 env:
607 pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
586 T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: ${{ steps.resource_monitor_cache.outputs.cache-hit == 'true' }}608 T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: ${{ steps.resource_monitor_cache.outputs.cache-hit == 'true' }}
587 CSC_LINK: ${{ secrets.CSC_LINK }}609 CSC_LINK: ${{ secrets.CSC_LINK }}
588 CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}610 CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
docs/internals/ci.md+5
...@@ -28,4 +28,9 @@ signing only when platform credentials are present. macOS passkey builds additio...@@ -28,4 +28,9 @@ signing only when platform credentials are present. macOS passkey builds additio
28`APPLE_TEAM_ID` and the `MACOS_PROVISIONING_PROFILE` secret; Windows uses Azure Trusted Signing.28`APPLE_TEAM_ID` and the `MACOS_PROVISIONING_PROFILE` secret; Windows uses Azure Trusted Signing.
29Without the core signing credentials, it still releases unsigned artifacts.29Without the core signing credentials, it still releases unsigned artifacts.
3030
31Preflight shares pnpm's lockfile verification results with the desktop build jobs through a small
32artifact. This avoids repeating dependency checks, especially on Windows, without transferring the
33large registry metadata cache. pnpm checks the current lockfile and policy before it reuses a result.
34If the artifact is unavailable, installation runs the checks again.
35
31See [Release Checklist](../operations/release.md) for the full release/signing setup checklist.36See [Release Checklist](../operations/release.md) for the full release/signing setup checklist.