ci: cache Typst builds and unblock parallel browser tests - #3160

Summary

• Cache the distributable Typst WASM by Rust/toolchain/build-tool inputs, with no fallback to stale keys. Validate its content hash before reuse; do not cache the multi-GB Rust target tree.
• Start six non-PDF browser shards immediately; only the three PDF browser jobs depend on the compiler. Merge all reports together.
• Apply exclusions at both Vitest configuration levels, preserving desktop mobile exclusions. All existing PDF functionality and snapshots still run.
• Always execute unit tests; avoid redundant dependency-cache uploads from browser/report jobs.
• Make the WASM freshness hash independent of checkout location and use GitHub's recommended self-repository action references.
• Restore library task outputs with stable inputs across fresh runners: work around Vite Task's generated-directory fingerprint issue, exclude pnpm's machine-specific metadata, and explicitly track the lockfile/workspace dependency graph.
• Merge browser reports on a host runner instead of starting another Playwright container, preserving the recorded canonical checkout root and report source snippets. Browser tests still run in Docker.
• Remove duplicate installs already performed by the pinned setup action. Reuse immutable task-cache snapshots per merge commit and start a fresh cache generation weekly.

Measured results

Durations below are earliest job start to last job completion, including report preview; runner scheduling still introduces variation.

All optimized timing samples in the table passed Build, six non-PDF shards, three PDF browser jobs, report merge, and preview jobs. The final two passing runs are 51–58% below these historical baselines, not a guaranteed bound. Report merging dropped from 106s to 46–51s after removing its container; browser/report work and runner scheduling now dominate total duration. The WASM archive is approximately 8 MB compressed; restore takes roughly 1 second. Cold Rust compilation remains necessary when its inputs change, but no longer blocks non-PDF tests. The initial cold compiler job took 4m26s; that workflow exposed a Vitest exclusion override and its non-PDF jobs timed out. The exclusion fix was verified with test discovery and passing workflows.

Vite+ task-cache investigation

The initial official cache approach restored successfully but achieved 0/44, then 1/44 task hits (82 ms saved). A follow-up reproduced Vite Task #504: generated types/ entries invalidate automatic package-root directory listings even when output files are excluded. pnpm's machine-specific node_modules/.modules.yaml also invalidated bundler tasks.

scripts/build-cache-inputs.ts now preserves automatic source/dependency tracking, excludes only the exact package-root listing plus generated outputs and pnpm metadata, explicitly tracks root configuration files, and fingerprints pnpm-lock.yaml/pnpm-workspace.yaml. Declaration outputs are included for dev-scripts. Only the Build job restores the task cache; tests still execute with --no-cache.

The first fresh-runner warm rerun achieved 37/44 hits (84%) and reduced package builds 33s → 19s. The remaining misses were diagnosed and fixed without ignoring real source changes:

• Apply the portable input helper to the compiler and playground, retaining explicit Rust source/toolchain inputs and excluding generated Rust targets.
• Load the AI package's full environment only for tests, not builds, so unrelated per-run environment IDs no longer invalidate bundling.
• Replace the two README copy commands with one task whose destinations are declared outputs, retaining the existing prebuild lifecycle.

Fresh-runner warm runs achieved 43/43 hits (100%), with Vite Task reporting approximately 64s of aggregate task execution avoided (not wall time). Package builds took 2s, versus 24s in the seeding run. The earlier task archive reached 151 MB compressed; restore and post-job save each took approximately 3s. Unit tests still executed with 0/17 hits because --no-cache is intentional. Cache keys now identify the week and exact merge commit rather than every run/attempt: same-commit reruns reuse the snapshot, and a weekly namespace with no older fallback prevents indefinite accumulation inside restored archives. This is not a hard byte limit or explicit deletion of old GitHub cache entries; normal cache eviction still applies. Runner variation prevents attributing all timing differences solely to caching.

Metadata-only PR edits remain unchanged: blindly skipping required jobs can overwrite failed checks with passing skipped checks for the same SHA. No test coverage, required-job identity, or deployment permissions were relaxed for a nominal speedup.

The final same-commit rerun restored the exact 90 MB v3 task snapshot, retained 43/43 hits, and logged Cache hit occurred on the primary key …, not saving cache. Thus the rerun did not create another task-cache archive.

Validation and review

• Formatting and commit-hook lint checks pass. Native browser execution was not used; browser validation ran in the existing Playwright Docker jobs.
• Chromium/Firefox/WebKit discovery confirms PDF files are absent from non-PDF jobs; Chromium removes exactly the two intended files.
• Security bot's two self-repository reference findings addressed. The installed actionlint 1.7.12 predates the supported $/ syntax; initial workflow lint passed before adopting it, and GitHub Actions runtime validated it in both successful runs.
• CodeRabbit comments reviewed. Its report-merging condition finding is already satisfied by if: ${{ !cancelled() }} in the current workflow; replied with the verification. Automatic reviews paused after several commits; explicitly requested a final review. Completed review covers the final fe2c5 commit and reports minimal merge risk, with no actionable merge-blocking issue established.
• Rebase against origin/main completed (already up to date).
• Latest implementation passed every build, browser, report, and preview job in both seeding and warm runs. Local probes verified clean-output replay and invalidation after source edits, lockfile edits, workspace dependency declaration edits, newly added root configuration files, README edits, playground source edits, and Rust source edits.
• Host report replay was checked with both passing and known-failing blobs: exact task/state, all 71 source snippets, and unhandled-error parity with the container reports; correct success/failure exit codes. An initial forward-symlink attempt exposed Vitest's canonical-root IDs and was corrected by relocating only the disposable report checkout, not suppressing failures.
• A separate run on the earlier WASM-only commit (37506338345) failed the existing comment-reaction test with Selector not found: .bn-thread-comment; its HTML report was generated and uploaded, but the merger returned the test-failure exit code. The subsequent run passed all jobs in 6m27s, including that test. This intermittent test failure is not hidden by the passing timing samples.
• The task-cache seeding attempt also hit that same comment-reaction failure; its Build job succeeded and saved the cache. The full warm rerun passed the test and all jobs.

Related build design: #3020.

Summary by CodeRabbit

• Chores
  • Updated build workflows to restore build caches and run browser tests in separate groups.
  • PDF browser tests now run across Chromium, Firefox, and WebKit in a dedicated job; other browser tests no longer wait for compiler artifacts.
  • Unit tests run without cached results, and dependency-cache saves are disabled for selected workflow jobs.
  • Build caches now track relevant source changes and runner details, helping keep restored results appropriately scoped.