ci: add 6 new workflows, Blacksmith runners, and CI speed optimizations

[dhairyashiil]

ci: add 6 new CI workflows + speed optimizations to companion

Summary

Adds CI workflows ported/adapted from calcom/cal to improve companion's CI coverage. Currently companion only has lint, typecheck, and build jobs.

New workflows:

1. Security Audit — runs bun pm untrusted and attempts a vulnerability audit on PRs and pushes to main
2. Semantic PR Titles — enforces conventional commit format on PR titles with a sticky comment explaining errors
3. Bundle Size Analysis — builds the browser extension, measures .output/ size, uploads baseline on main. On PRs, only posts a comment if the bundle size increases by more than 5KB compared to main (silent when size is stable or decreasing)
4. PR Labeler — auto-labels PRs based on changed files (extension, mobile, config, ci, api) and propagates labels from linked issues
5. Cache Cleanup — deletes GitHub Actions caches for a branch when its PR is closed
6. Changes Requested → Re-draft — auto-converts PRs back to draft when a reviewer requests changes (two-workflow pattern for fork support)

CI speed optimizations (applied to existing ci.yml and new workflows):

• Blacksmith runners — switched compute-heavy jobs (build, bundle-analysis) to blacksmith-4vcpu-ubuntu-2404 and lighter jobs (lint, typecheck, security-audit, cache-clean) to blacksmith-2vcpu-ubuntu-2404 for ~2x faster execution. Trivial GitHub API workflows (labeler, semantic-pull-requests, re-draft, on-changes-requested) remain on ubuntu-latest.
• Concurrency groups on ci.yml, security-audit.yml, and bundle-analysis.yml — cancels in-progress runs when a new push arrives on the same PR
• Build caching for the Expo web export (dist/) and browser extension (.output/) in the build job — skips rebuilds when source files haven't changed
• Dependency caching added to security-audit.yml (was already present in ci.yml via setup-bun)

Review & Testing Checklist for Human

• Blacksmith must be enabled for the companion repo: If Blacksmith is only configured for calcom/cal and not org-wide or calcom/companion specifically, every CI job on a Blacksmith runner will fail with a "no matching runner" error. Verify in the Blacksmith console before merging.
• Security audit is effectively a no-op: bunx audit is not a real Bun command. Both steps end with || true so the job will never fail on vulnerabilities. Consider replacing with npm audit --production --audit-level=critical or removing || true from the critical step — otherwise this workflow only provides false confidence.
• Build cache glob completeness: The Expo web cache key hashes app/**, components/**, hooks/**, etc. but does not include utils/**, global.css, or other root-level files that may affect the build. A change to an unlisted directory won't invalidate the cache, potentially passing CI with stale build output. Verify the globs cover all directories that influence the Expo and extension builds.
• Output path assumptions: The build cache assumes bunx expo export --platform web outputs to dist/ and bun run ext:build outputs to .output/. If either path is wrong, caching and bundle analysis will silently do nothing. Verify both paths.
• Labels must be created in repo settings: The labeler workflow applies labels but doesn't create them. Ensure extension, mobile, config, ci, and api labels exist in the companion repo's GitHub settings before merging.

Suggested test plan: After merge, open a test PR that touches a file in extension/ and verify: (1) CI runs on Blacksmith runners without "no matching runner" errors, (2) the labeler applies the extension label, (3) semantic PR title check runs, (4) bundle analysis runs but doesn't post a comment (unless size increases >5KB), (5) security audit job runs, (6) pushing again to the same PR cancels the previous in-progress CI run. For re-draft, have someone request changes on a PR and confirm it converts to draft. For build caching, push a second commit with no source changes and confirm the build step is skipped.

Notes

• Blacksmith runners are 2x faster than ubuntu-latest and use the same pricing model as cal.com's CI
• The re-draft workflow uses the same two-step artifact-passing pattern as cal.com (needed for fork PR secrets access)
• Bundle analysis only comments when size increases beyond threshold — won't spam PRs with "no change" comments
• Build caching uses actions/cache@v4 with content-based keys (hashFiles()) to invalidate when source files change
• Most workflows can only be fully tested after merge since they trigger on real GitHub events

Link to Devin run: https://app.devin.ai/sessions/292c913761564e91aab85809b8ff9c86
Requested by: @dhairyashiil

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[github-actions]

🔴 Bundle Size Analysis

	Size
Extension (current)	139.04 KB
Extension (main)	N/A (no baseline yet)

[github-actions]

🔴 Bundle Size Analysis

	Size
Extension (current)	139.04 KB
Extension (main)	N/A (no baseline yet)

[github-actions]

🔴 Bundle Size Analysis

	Size
Extension (current)	139.04 KB
Extension (main)	N/A (no baseline yet)

[cubic-dev-ai]

3 issues found across 9 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/cache-clean.yml">

<violation number="1" location=".github/workflows/cache-clean.yml:9">
P2: Cache deletion requires `actions: write` on the `GITHUB_TOKEN`. Without an explicit permissions block, `gh actions-cache delete` will fail on the default read-only token and the cleanup job won’t actually remove caches. Add job permissions for `actions: write` (and `contents: read` for checkout).</violation>
</file>

<file name=".github/workflows/security-audit.yml">

<violation number="1" location=".github/workflows/security-audit.yml:34">
P2: This step never fails and also calls the wrong audit command/flags. Bun’s audit is `bun audit --prod --audit-level=critical`; `bunx audit ... || true` bypasses failures and likely runs an unrelated package, so vulnerabilities won’t block CI as intended.</violation>
</file>

<file name=".github/workflows/ci.yml">

<violation number="1" location=".github/workflows/ci.yml:73">
P2: The Expo web cache key omits `utils/**`, so updates to shared utilities won’t invalidate the cache and can skip rebuilding `dist`, leaving stale artifacts. Include `utils/**` (and other shared root inputs) in the hashFiles list.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}