[currentbits]

Electron's postinstall download can fail with HTTP 504 before any tests run, even after the npm cache restores successfully (for example job 128708386644). npm caches package tarballs, while the locked Electron installer downloads its distribution separately.

Add a shared CI install action that caches only Electron distribution archives under an explicit runner-temp path, keyed exactly by the locked Electron version, native Node platform and architecture. Restore, installer and save use that same path on Windows, macOS and Linux, independent of HOME/LOCALAPPDATA/XDG_CACHE_HOME. Save immediately after successful npm ci so later suite failures do not discard a verified download. Cover test, smoke, both Linux headless architectures and server-bundle installs; action edits trigger the bundle workflow too.

The pinned electron@35.7.5 / @electron/get@2.0.3 installer still downloads from official GitHub releases and verifies fresh and cached ZIPs against checksums bundled in its npm-integrity-pinned package. No mirror, broad restore keys, binary-download skip or test/smoke changes. The separate ONNX CUDA fix #1952 is untouched. Cold or evicted caches still need the upstream endpoint; caches become available to sibling feature branches through main after merge.

Validation:

• Full isolated cold npm ci from empty npm/Electron caches, then a fresh-directory npm ci --offline with changed HOME and HTTP(S) requests forbidden: passed on macOS arm64, with miss/hit logs.
• Pinned installer cold/warm installs of official Windows x64, Linux x64/arm64 and macOS x64 archives: passed with different HOME/USERPROFILE/LOCALAPPDATA/XDG_CACHE_HOME; warm HTTP(S) blocked. Foreign binaries were verified/extracted, not executed locally.
• Deliberately corrupted cache: bundled checksum verification rejected it before extraction; official redownload attempted, failed as expected with networking forbidden.
• Isolated core and Vite builds plus real macOS arm64 npm run test:smoke (smoke.js A–E and preview-smoke.js): passed with inherited CODER_* removed and provider CLIs absent from PATH.
• Exact key generation checked for all five target combinations; matching restore/install/save paths checked. actionlint -shellcheck= and git diff --check pass. Standard actionlint reports only the existing SC2086 in the unchanged headless script, reproduced against main.

Tracks #1955; leave open until merged. This branch is based on main and contains only the CI cache change.

Created with GPT-6.1 Sol in Codex.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-08T13:22:03.479086Z	eba3bee	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.