authorgravatar for me@t3.ggTheo Browne <me@t3.gg> 2026-09-03 03:13:15-07:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2026-09-03 03:13:15-07:00
logfff33f9e851912363c5b1f3ac65598be35eb5f0d
treeb8e876d03ee995256ae86d57ca5adc18d9ded0d5
parent1e051873094c0c75cd35fef89c90461c22cce76b
signature Signed by PGP key B5690EEEBB952194

perf(ci): reuse dependency checks in release builds (#9399)

2 files changed, 27 insertions(+), 0 deletions(-)

.github/workflows/release.yml+22
......@@ -111,6 +111,8 @@ jobs:
111111 node-version-file: package.json
112112 cache: true
113113 run-install: true
114 env:
115 pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
114116
115117 - id: release_meta
116118 name: Resolve release version
......@@ -174,6 +176,14 @@ jobs:
174176 --current-tag "${{ steps.release_meta.outputs.tag }}" \
175177 --github-output
176178
179 # Share only the verification results, not the large registry metadata cache.
180 - name: Upload dependency verification
181 continue-on-error: true
182 uses: actions/upload-artifact@v7
183 with:
184 name: release-dependency-verification
185 path: ${{ runner.temp }}/pnpm-metadata/lockfile-verified.jsonl
186
177187 quality:
178188 name: Release quality checks
179189 needs: [preflight]
......@@ -446,7 +456,18 @@ jobs:
446456 path: ${{ steps.package_cache_path.outputs.path }}
447457 key: windows-release-packages-v1-${{ matrix.arch }}-${{ hashFiles('pnpm-lock.yaml') }}
448458
459 # pnpm checks the lockfile and policy before reusing this result. A missing
460 # artifact leaves the cache empty, so installation runs the checks again.
461 - name: Download dependency verification
462 continue-on-error: true
463 uses: actions/download-artifact@v8
464 with:
465 name: release-dependency-verification
466 path: ${{ runner.temp }}/pnpm-metadata
467
449468 - name: Install desktop dependencies
469 env:
470 pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
450471 run: vp install --filter=@t3tools/desktop... --filter=t3... --filter=@t3tools/scripts...
451472
452473 - name: Cache resource monitor
......@@ -583,6 +604,7 @@ jobs:
583604 - name: Build desktop artifact
584605 shell: bash
585606 env:
607 pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
586608 T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: ${{ steps.resource_monitor_cache.outputs.cache-hit == 'true' }}
587609 CSC_LINK: ${{ secrets.CSC_LINK }}
588610 CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
docs/internals/ci.md+5
......@@ -28,4 +28,9 @@ signing only when platform credentials are present. macOS passkey builds additio
2828`APPLE_TEAM_ID` and the `MACOS_PROVISIONING_PROFILE` secret; Windows uses Azure Trusted Signing.
2929Without the core signing credentials, it still releases unsigned artifacts.
3030
31Preflight shares pnpm's lockfile verification results with the desktop build jobs through a small
32artifact. This avoids repeating dependency checks, especially on Windows, without transferring the
33large registry metadata cache. pnpm checks the current lockfile and policy before it reuses a result.
34If the artifact is unavailable, installation runs the checks again.
35
3136See [Release Checklist](../operations/release.md) for the full release/signing setup checklist.