perf: reuse verified Node and run the layout check with Bun (#28218)

* perf: overlap preflight daemon smoke and reuse verified Node executable

* Keep measured Node reuse and Bun layout wins; drop smoke scheduling experiments

.github/workflows/pr.yml

@@ -355,7 +355,7 @@ jobs:
 
       - name: Enforce layout-writer ratchets
         if: needs.code_paths.outputs.static_analysis == 'true'
-        run: pnpm run check:layout-writer-ratchets
+        run: bun config/scripts/check-layout-writer-ratchets.mjs
 
       - name: Check compatibility-folder imports
         if: needs.code_paths.outputs.static_analysis == 'true'

config/scripts/pinned-node-downloads.mjs

@@ -1,6 +1,6 @@
 // Hash-verified downloads of the pinned Node's build inputs (headers, node.lib) and executable.
 import { chmodSync, copyFileSync, existsSync, mkdirSync, rmSync } from 'node:fs'
-import { join, resolve } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
 import {
   NODE_RUNTIME_PIN,
   isWindowsServerTarget,
@@ -18,6 +18,26 @@ export function pinnedNodeCacheDir(env = process.env) {
   return env.ORCA_NODE_RUNTIME_CACHE_DIR || join(ROOT, 'out', 'node-runtime-cache')
 }
 
+export async function copyPinnedNodeExecutable(source, destination, sha256) {
+  try {
+    if ((await sha256File(source)) !== sha256) {
+      return false
+    }
+  } catch {
+    return false
+  }
+  mkdirSync(dirname(destination), { recursive: true })
+  copyFileSync(source, destination)
+  if ((await sha256File(destination)) !== sha256) {
+    rmSync(destination, { force: true })
+    throw new Error(`Node executable changed while copying ${source}`)
+  }
+  if (process.platform !== 'win32') {
+    chmodSync(destination, 0o755)
+  }
+  return true
+}
+
 /** Reuses a cached file only when it still hashes to the pin; anything else is re-fetched. */
 export async function fetchPinnedFile({ url, destination, sha256 }) {
   if (existsSync(destination) && (await sha256File(destination)) === sha256) {
@@ -77,6 +97,10 @@ export async function ensurePinnedNodeExecutable({ target, cacheDir = pinnedNode
   if (existsSync(executable) && (await sha256File(executable)) === asset.executableSha256) {
     return executable
   }
+  // setup-node often already supplies these exact bytes; version equality alone is insufficient.
+  if (await copyPinnedNodeExecutable(process.execPath, executable, asset.executableSha256)) {
+    return executable
+  }
   const archive = await fetchPinnedFile({
     url: nodeRuntimeReleaseUrl(asset.source, asset.archive),
     destination: join(cacheDir, asset.archive),

config/scripts/pinned-node-downloads.test.mjs

@@ -0,0 +1,61 @@
+import { createHash } from 'node:crypto'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it } from 'vitest'
+import { copyPinnedNodeExecutable } from './pinned-node-downloads.mjs'
+
+const directories = []
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'pinned-node-copy-'))
+  directories.push(directory)
+  const source = join(directory, 'host-node')
+  const destination = join(directory, 'cache', 'bin', 'node')
+  const bytes = Buffer.from('pinned executable bytes')
+  writeFileSync(source, bytes, { mode: 0o600 })
+  return { source, destination, bytes, hash: createHash('sha256').update(bytes).digest('hex') }
+}
+
+it('copies only the exact pinned executable and makes the cached copy runnable on POSIX', async () => {
+  const { source, destination, bytes, hash } = fixture()
+  expect(await copyPinnedNodeExecutable(source, destination, hash)).toBe(true)
+  expect(readFileSync(destination)).toEqual(bytes)
+  if (process.platform !== 'win32') {
+    expect(statSync(destination).mode & 0o777).toBe(0o755)
+  }
+})
+
+it('falls back when the host executable differs from the pin without staging it', async () => {
+  const { source, destination } = fixture()
+  expect(await copyPinnedNodeExecutable(source, destination, '0'.repeat(64))).toBe(false)
+  expect(existsSync(destination)).toBe(false)
+})
+
+it('falls back when the candidate executable is unavailable', async () => {
+  const { source, destination, hash } = fixture()
+  rmSync(source)
+  expect(await copyPinnedNodeExecutable(source, destination, hash)).toBe(false)
+  expect(existsSync(destination)).toBe(false)
+})
+
+it('falls back when the candidate cannot be read as an executable file', async () => {
+  const { source, destination, hash } = fixture()
+  rmSync(source)
+  mkdirSync(source)
+  expect(await copyPinnedNodeExecutable(source, destination, hash)).toBe(false)
+  expect(existsSync(destination)).toBe(false)
+})