perf(ci): speed up PR CI wall clock and local dev builds

.cargo/config.toml

@@ -0,0 +1,5 @@
+[profile.dev]
+# Full file/line backtraces, no per-variable debug info. ~20-30% faster
+# builds and much faster macOS link. Need lldb locals? Override per-shell:
+# CARGO_PROFILE_DEV_DEBUG=2
+debug = "line-tables-only"

.github/workflows/ci.yml

@@ -4,6 +4,10 @@ on:
     branches: [main, release]
   pull_request:
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
   CARGO_TERM_COLOR: always
   PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.cache/ms-playwright
@@ -81,6 +85,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+      - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
@@ -102,6 +107,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+      - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: desktop/src-tauri
@@ -264,6 +270,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+      - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: |
@@ -474,7 +481,8 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
-          channel: stable
+          flutter-version: 3.41.7  # keep in sync with hermit pin (bin/.flutter-3.41.7.pkg)
+          cache: true
       - name: Install dependencies
         run: cd mobile && flutter pub get
       - name: Format check
@@ -547,8 +555,10 @@ jobs:
       - name: Build server binaries
         env:
           TARGET: ${{ matrix.target }}
+          # PRs: compile + build-script gate only (no codegen/link). Main: full link gate.
+          CARGO_CMD: ${{ github.event_name == 'pull_request' && 'check' || 'build' }}
         run: |
-          cross build --release --target "$TARGET" \
+          cross "$CARGO_CMD" --release --target "$TARGET" \
             -p buzz-relay \
             -p buzz-acp \
             -p buzz-agent \

.github/workflows/release.yml

@@ -15,16 +15,82 @@ on:
         required: true
 
 jobs:
+  create-release:
+    name: Create GitHub Release
+    if: github.repository == 'block/buzz'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Determine version
+        id: version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          if [[ "$EVENT_NAME" == "push" ]]; then
+            VERSION="${GITHUB_REF_NAME#v}"
+          else
+            VERSION="$INPUT_VERSION"
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+      - name: Validate version
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
+            echo "::error::Invalid version '$VERSION'. Expected semver (e.g. 0.4.0 or 1.0.0-beta.1)"
+            exit 1
+          fi
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          ref: ${{ github.event_name == 'push' && github.ref || inputs.ref }}
+          persist-credentials: false
+      - name: Create versioned GitHub release
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          RELEASE_SHA=$(git rev-parse HEAD)
+          NOTES=""
+          if [[ -f CHANGELOG.md ]]; then
+            NOTES=$(awk "/^## v${VERSION}$/,/^## v/" CHANGELOG.md | sed '$d')
+          fi
+          if [[ -z "$NOTES" ]]; then
+            NOTES="Buzz Desktop v${VERSION}"
+          fi
+          PRERELEASE_FLAGS=()
+          if [[ "$VERSION" =~ -(test|alpha|beta|rc)([.-]|$) ]]; then
+            PRERELEASE_FLAGS=(--prerelease --latest=false)
+          fi
+          gh release create "v${VERSION}" \
+            --target "$RELEASE_SHA" \
+            --title "Buzz Desktop v${VERSION}" \
+            --notes "$NOTES" \
+            "${PRERELEASE_FLAGS[@]}"
+      - name: Ensure rolling release exists
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create buzz-desktop-latest \
+            --prerelease \
+            --title "Buzz Desktop Auto-Update" \
+            --notes "Rolling release for the Tauri auto-updater. Do not download manually — use the versioned release instead." \
+            2>/dev/null || true
+
   release:
     name: Release
     if: github.repository == 'block/buzz'
+    needs: [create-release]
     runs-on: macos-latest
     timeout-minutes: 60
     permissions:
       contents: write
       id-token: write # required by block/apple-codesign-action for OIDC
     outputs:
-      version: ${{ steps.version.outputs.version }}
       archive_name: ${{ steps.artifacts.outputs.archive_name }}
       sig: ${{ steps.read-sig.outputs.sig }}
     steps:
@@ -218,30 +284,12 @@ jobs:
         env:
           SIG_PATH: ${{ steps.artifacts.outputs.sig }}
 
-      - name: Create versioned GitHub release
+      - name: Upload arm64 DMG to versioned GitHub release
         env:
           VERSION: ${{ steps.version.outputs.version }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DMG_PATH: ${{ steps.artifacts.outputs.dmg }}
-        run: |
-          RELEASE_SHA=$(git rev-parse HEAD)
-          NOTES=""
-          if [[ -f CHANGELOG.md ]]; then
-            NOTES=$(awk "/^## v${VERSION}$/,/^## v/" CHANGELOG.md | sed '$d')
-          fi
-          if [[ -z "$NOTES" ]]; then
-            NOTES="Buzz Desktop v${VERSION}"
-          fi
-          PRERELEASE_FLAGS=()
-          if [[ "$VERSION" =~ -(test|alpha|beta|rc)([.-]|$) ]]; then
-            PRERELEASE_FLAGS=(--prerelease --latest=false)
-          fi
-          gh release create "v${VERSION}" \
-            --target "$RELEASE_SHA" \
-            --title "Buzz Desktop v${VERSION}" \
-            --notes "$NOTES" \
-            "${PRERELEASE_FLAGS[@]}" \
-            "$DMG_PATH"
+        run: gh release upload "v${VERSION}" "$DMG_PATH" --clobber
 
       - name: Upload updater archive to rolling release
         run: |
@@ -263,7 +311,7 @@ jobs:
     name: Release macOS (Intel)
     if: github.repository == 'block/buzz'
     runs-on: macos-latest
-    needs: release
+    needs: create-release
     timeout-minutes: 60
     permissions:
       contents: write
@@ -272,7 +320,7 @@ jobs:
       archive_name: ${{ steps.artifacts.outputs.archive_name }}
       sig: ${{ steps.read-sig.outputs.sig }}
     env:
-      VERSION: ${{ needs.release.outputs.version }}
+      VERSION: ${{ needs.create-release.outputs.version }}
       TARGET: x86_64-apple-darwin
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -411,7 +459,7 @@ jobs:
     name: Release Linux
     if: github.repository == 'block/buzz'
     runs-on: ubuntu-latest
-    needs: release
+    needs: create-release
     timeout-minutes: 60
     permissions:
       contents: write
@@ -462,7 +510,7 @@ jobs:
 
       - name: Patch version
         env:
-          VERSION: ${{ needs.release.outputs.version }}
+          VERSION: ${{ needs.create-release.outputs.version }}
         run: |
           cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
           cd src-tauri && cargo update --workspace
@@ -531,7 +579,7 @@ jobs:
       # NOTE: .deb is NOT auto-updatable (Tauri updater constraint — only AppImage supports it on Linux)
       - name: Upload Linux artifacts to versioned GitHub release
         env:
-          VERSION: ${{ needs.release.outputs.version }}
+          VERSION: ${{ needs.create-release.outputs.version }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DEB_PATH: ${{ steps.linux-artifacts.outputs.deb }}
           APPIMAGE_PATH: ${{ steps.linux-artifacts.outputs.appimage }}
@@ -555,15 +603,15 @@ jobs:
   release-windows:
     name: Release Windows
     runs-on: windows-latest
-    needs: release
+    needs: create-release
     timeout-minutes: 60
     permissions:
       contents: write
     outputs:
       archive_name: ${{ steps.artifacts.outputs.archive_name }}
       sig: ${{ steps.read-sig.outputs.sig }}
     env:
-      VERSION: ${{ needs.release.outputs.version }}
+      VERSION: ${{ needs.create-release.outputs.version }}
       TARGET: x86_64-pc-windows-msvc
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -678,12 +726,12 @@ jobs:
   assemble-manifest:
     name: Assemble multi-platform latest.json
     runs-on: ubuntu-latest
-    needs: [release, release-macos-x64, release-linux, release-windows]
+    needs: [create-release, release, release-macos-x64, release-linux, release-windows]
     timeout-minutes: 10
     permissions:
       contents: write
     env:
-      VERSION: ${{ needs.release.outputs.version }}
+      VERSION: ${{ needs.create-release.outputs.version }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.gitignore

@@ -12,7 +12,8 @@
 
 # Editor / IDE
 .idea/
-.vscode/
+.vscode/*
+!.vscode/settings.json
 *.swp
 *.swo
 *~

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "rust-analyzer.cargo.targetDir": true
+}

Cargo.toml

@@ -119,13 +119,19 @@ buzz-media = { path = "crates/buzz-media" }
 buzz-sdk = { path = "crates/buzz-sdk" }
 buzz-ws-client = { path = "crates/buzz-ws-client" }
 
-# CI profile — release-grade codegen for the relay so e2e tests hit a
-# realistic binary, not an unoptimised debug build.  Inherits `release`
-# defaults (opt-level 3, no debug-assertions) but keeps incremental
-# compilation enabled and avoids LTO so the build stays fast.
+# CI profile — builds the relay for desktop e2e. Dependencies keep full
+# release optimization (warm from main's cache; they carry the runtime hot
+# path: tokio/sqlx/axum). Workspace crates build at opt-level 1 — enough for
+# stable e2e timing (PR #307 flakiness was opt-0 + debug-assertions) at
+# roughly half the codegen cost. `incremental` is irrelevant in CI:
+# rust-cache exports CARGO_INCREMENTAL=0 and never caches member artifacts.
 [profile.ci]
 inherits = "release"
 lto = false
+opt-level = 1
+
+[profile.ci.package."*"]
+opt-level = 3
 
 # Sprig profile — optimized for deploy-anywhere Sprig release artifacts.
 # Sprig is distributed over the network and installed on fresh hosts, so binary

lefthook.yml

@@ -20,10 +20,6 @@ pre-commit:
 pre-push:
   parallel: true
   commands:
-    rust-clippy:
-      run: just clippy
-    desktop-tauri-clippy:
-      run: just desktop-tauri-clippy
     rust-tests:
       run: just test-unit
     desktop-test: