ci(j5): run the release's builds side by side

.github/workflows/j5-macos-build.yml

@@ -1,7 +1,7 @@
 name: J5 Signed macOS Build
 
 # Run by hand on a branch, it builds that branch at the version its manifests
-# commit (docs/j5/runbooks/macos-packaging.md). Called by J5 Nightly, it builds
+# commit (docs/j5/runbooks/macos-packaging.md). Called by J5 Release, it builds
 # `ref` and stamps `version` into the manifests first, so nothing is committed.
 on:
   workflow_dispatch:

.github/workflows/j5-nightly.yml

@@ -84,27 +84,11 @@ jobs:
               subprocess.run(["git", "update-index", "--force-remove", "-z", "--stdin"], input=b"\0".join(paths) + b"\0", check=True)
           PYTHON
 
-  build:
-    name: Desktop build
-    needs: resolve
-    if: needs.resolve.outputs.due == 'true'
-    permissions:
-      contents: read
-    uses: ./.github/workflows/j5-macos-build.yml
-    with:
-      ref: ${{ needs.resolve.outputs.ref }}
-      version: ${{ needs.resolve.outputs.version }}
-    secrets:
-      CSC_LINK: ${{ secrets.CSC_LINK }}
-      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-      APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-
-  # Builds the CLI archives and publishes them with the desktop build above.
+  # Builds the desktop app and the CLI archives, and publishes them.
   release:
     name: Release
-    needs: [resolve, build]
+    needs: resolve
+    if: needs.resolve.outputs.due == 'true'
     permissions:
       contents: write
       actions: read

.github/workflows/j5-release.yml

@@ -1,8 +1,9 @@
 name: J5 Release
 
 # Publishes one J5 Code release to this repository's GitHub Releases:
-#   - the signed and notarized macOS desktop build from a successful
-#     "J5 Signed macOS Build" run (DMG, ZIP, blockmaps, updater metadata);
+#   - the signed and notarized macOS desktop build (DMG, ZIP, blockmaps,
+#     updater metadata): built in this run when called, or taken from the
+#     successful "J5 Signed macOS Build" run a manual run names;
 #   - self-contained CLI archives for darwin-arm64 (Developer ID signed and
 #     notarized), linux-x64 and win32-x64, built here from the same source
 #     commit with upstream's scripts/build-cli-archive.ts;
@@ -28,7 +29,12 @@ name: J5 Release
 # Nightly, which calls this workflow with a commit and a version; a manual run
 # refuses a nightly version, and a call refuses any other. The version is
 # then stamped into the manifests at build time instead of being read from them,
-# and the desktop build is the one J5 Nightly made earlier in the same run.
+# and the desktop app is built by this run's `desktop` job.
+#
+# The builds run side by side and only `release` waits for all of them. Each
+# macOS job is one more wait for a scarce macOS runner, so there are two:
+# `desktop` and the darwin-arm64 CLI archive, which builds its own resource
+# monitor.
 #
 # No checkout here sets `persist-credentials: false`: it makes checkout fail on
 # the vendored gitlinks (FORK.md, "J5 CI and packaging"). The one job with a
@@ -186,6 +192,23 @@ jobs:
               ? `J5 Code ${version} is already published; nothing to do.`
               : `Publishing J5 Code ${version}${channel === 'stable' ? '' : ` as a ${channel}`} from ${sha}.`);
 
+  desktop:
+    name: Desktop build
+    needs: resolve
+    if: needs.resolve.outputs.published != 'true' && needs.resolve.outputs.stamp == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/j5-macos-build.yml
+    with:
+      ref: ${{ needs.resolve.outputs.ref }}
+      version: ${{ needs.resolve.outputs.version }}
+    secrets:
+      CSC_LINK: ${{ secrets.CSC_LINK }}
+      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+      APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+
   verify:
     needs: resolve
     if: needs.resolve.outputs.published != 'true'
@@ -241,27 +264,23 @@ jobs:
     with:
       ref: ${{ needs.resolve.outputs.ref }}
 
-  cli_archive:
-    needs: [resolve, verify, monitors]
+  # Two jobs rather than one matrix, so `windows` waits only for the Linux
+  # archive it embeds. Both run the steps anchored here.
+  cli_archive_linux:
+    needs: [resolve, monitors]
     if: needs.resolve.outputs.published != 'true'
     strategy:
-      fail-fast: true
       matrix:
         include:
-          - platform: mac
-            arch: arm64
-            key: darwin-arm64
-            runner: macos-15
           - platform: linux
             arch: x64
             key: linux-x64
-            runner: ubuntu-24.04
     name: CLI archive ${{ matrix.key }}
-    runs-on: ${{ matrix.runner }}
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     env:
       RELEASE_VERSION: ${{ needs.resolve.outputs.version }}
-    steps:
+    steps: &cli-archive-steps
       - uses: actions/checkout@v6
         with:
           ref: ${{ needs.resolve.outputs.ref }}
@@ -327,12 +346,34 @@ jobs:
           node-version-file: .nvmrc
 
       - uses: actions/download-artifact@v8
+        if: matrix.platform != 'mac'
         with:
           name: j5-resource-monitor-${{ matrix.key }}
           path: ${{ runner.temp }}/cli-resource-monitor/${{ matrix.key }}
 
+      # The same build and cache key as j5-resource-monitors.yml.
+      - uses: actions/cache@v6
+        id: monitor-cache
+        if: matrix.platform == 'mac'
+        with:
+          path: native/resource-monitor/target/aarch64-apple-darwin/release/t3-resource-monitor
+          key: j5-monitor-aarch64-apple-darwin-${{ hashFiles('native/resource-monitor/Cargo.lock', 'native/resource-monitor/Cargo.toml', 'native/resource-monitor/src/**') }}
+
+      - name: Build resource monitor
+        if: matrix.platform == 'mac' && steps.monitor-cache.outputs.cache-hit != 'true'
+        run: |
+          rustup toolchain install 1.95.0 --profile minimal --target aarch64-apple-darwin
+          cargo +1.95.0 build --locked --release --manifest-path native/resource-monitor/Cargo.toml --target aarch64-apple-darwin
+
       - name: Stage resource monitor
-        run: chmod +x "$RUNNER_TEMP/cli-resource-monitor/${{ matrix.key }}/t3-resource-monitor"
+        run: |
+          set -euo pipefail
+          dir="$RUNNER_TEMP/cli-resource-monitor/${{ matrix.key }}"
+          if [[ "${{ matrix.platform }}" == mac ]]; then
+            mkdir -p "$dir"
+            cp native/resource-monitor/target/aarch64-apple-darwin/release/t3-resource-monitor "$dir/"
+          fi
+          chmod +x "$dir/t3-resource-monitor"
 
       - name: Prepare Apple signing credentials
         if: matrix.platform == 'mac'
@@ -424,18 +465,42 @@ jobs:
               subprocess.run(["git", "update-index", "--force-remove", "-z", "--stdin"], input=b"\0".join(paths) + b"\0", check=True)
           PYTHON
 
+  cli_archive_mac:
+    needs: resolve
+    if: needs.resolve.outputs.published != 'true'
+    strategy:
+      matrix:
+        include:
+          - platform: mac
+            arch: arm64
+            key: darwin-arm64
+    name: CLI archive ${{ matrix.key }}
+    runs-on: macos-15
+    timeout-minutes: 45
+    env:
+      RELEASE_VERSION: ${{ needs.resolve.outputs.version }}
+    steps: *cli-archive-steps
+
   # Embeds the linux-x64 archive above as its WSL runtime.
   windows:
-    needs: [resolve, monitors, cli_archive]
+    needs: [resolve, monitors, cli_archive_linux]
     if: needs.resolve.outputs.published != 'true'
     uses: ./.github/workflows/j5-windows-build.yml
     with:
       ref: ${{ needs.resolve.outputs.ref }}
       version: ${{ needs.resolve.outputs.version }}
 
+  # `desktop` is skipped on a manual run, which publishes the build it names.
   release:
-    needs: [resolve, cli_archive, windows]
-    if: needs.resolve.outputs.published != 'true'
+    needs: [resolve, verify, desktop, cli_archive_linux, cli_archive_mac, windows]
+    if: >-
+      !cancelled()
+      && needs.resolve.outputs.published != 'true'
+      && needs.verify.result == 'success'
+      && needs.cli_archive_linux.result == 'success'
+      && needs.cli_archive_mac.result == 'success'
+      && needs.windows.result == 'success'
+      && (needs.desktop.result == 'success' || needs.resolve.outputs.stamp != 'true')
     runs-on: ubuntu-24.04
     permissions:
       contents: write
@@ -458,7 +523,7 @@ jobs:
       - uses: actions/download-artifact@v8
         with:
           name: j5-code-signed-macos-arm64
-          # A caller built the desktop app earlier in this same run.
+          # A caller's run built it in the `desktop` job.
           run-id: ${{ inputs.build_run_id || github.run_id }}
           github-token: ${{ github.token }}
           path: release-assets

.github/workflows/j5-resource-monitors.yml

@@ -1,5 +1,8 @@
 name: J5 CLI Resource Monitors
 
+# The linux-x64 and win32-x64 monitors for J5 Release. The darwin-arm64 CLI
+# archive builds its own on the Mac it already has: macOS runners are scarce.
+
 on:
   workflow_dispatch:
     inputs:
@@ -22,14 +25,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: macos-15
-            target: aarch64-apple-darwin
-            platform: darwin-arm64
-            binary: t3-resource-monitor
-          - runner: macos-15
-            target: x86_64-apple-darwin
-            platform: darwin-x64
-            binary: t3-resource-monitor
           - runner: ubuntu-24.04
             target: x86_64-unknown-linux-gnu
             platform: linux-x64