fix(ci): make accelerated checks runtime-safe

.github/actions/install-node-dependencies/action.yml

@@ -2,10 +2,10 @@ name: Install Node dependencies
 description: Installs the Node toolchain and repository dependencies for Linux CI jobs.
 
 inputs:
-  ignore-scripts:
-    description: Skip dependency lifecycle scripts when the job does not need native runtimes.
+  native-runtime:
+    description: Native runtime to prepare after the script-free install (none, node, or electron).
     required: false
-    default: 'false'
+    default: none
 
 runs:
   using: composite
@@ -22,9 +22,22 @@ runs:
         node-version-file: package.json
         cache: pnpm
 
+    - name: Validate native runtime
+      shell: bash
+      env:
+        NATIVE_RUNTIME: ${{ inputs.native-runtime }}
+      run: |
+        case "$NATIVE_RUNTIME" in
+          none|node|electron) ;;
+          *)
+            echo "::error::native-runtime must be none, node, or electron"
+            exit 2
+            ;;
+        esac
+
     # pnpm's bundled gyp_main.py is not executable on fresh Linux runners.
     - name: Use external node-gyp
-      if: inputs.ignore-scripts != 'true'
+      if: inputs.native-runtime != 'none'
       shell: bash
       run: |
         npm install -g node-gyp@11.5.0
@@ -40,15 +53,19 @@ runs:
 
     - name: Install dependencies
       shell: bash
-      env:
-        IGNORE_SCRIPTS: ${{ inputs.ignore-scripts }}
       run: |
-        install_args=(--no-frozen-lockfile --prefer-frozen-lockfile=false --os=current --os=win32 --cpu=current)
-        if [ "$IGNORE_SCRIPTS" = "true" ]; then
-          install_args+=(--ignore-scripts)
-        elif [ "$IGNORE_SCRIPTS" != "false" ]; then
-          echo "::error::ignore-scripts must be true or false"
-          exit 2
-        fi
-        pnpm install "${install_args[@]}"
+        pnpm install \
+          --no-frozen-lockfile \
+          --prefer-frozen-lockfile=false \
+          --os=current \
+          --os=win32 \
+          --cpu=current \
+          --ignore-scripts
         git diff --exit-code package.json pnpm-lock.yaml
+
+    - name: Prepare native runtime
+      if: inputs.native-runtime != 'none'
+      shell: bash
+      env:
+        NATIVE_RUNTIME: ${{ inputs.native-runtime }}
+      run: node config/scripts/ensure-native-runtime.mjs --runtime="$NATIVE_RUNTIME"

.github/workflows/pr.yml

@@ -24,8 +24,6 @@ jobs:
           persist-credentials: false
 
       - uses: ./.github/actions/install-node-dependencies
-        with:
-          ignore-scripts: 'true'
 
       - name: Lint
         run: pnpm exec oxlint --format github
@@ -73,8 +71,6 @@ jobs:
           persist-credentials: false
 
       - uses: ./.github/actions/install-node-dependencies
-        with:
-          ignore-scripts: 'true'
 
       - run: pnpm typecheck
 
@@ -89,8 +85,6 @@ jobs:
           persist-credentials: false
 
       - uses: ./.github/actions/install-node-dependencies
-        with:
-          ignore-scripts: 'true'
 
       - name: Verify Git binary compatibility matrix
         run: |
@@ -144,10 +138,11 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y zsh
 
       - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
 
       - name: Test real shell contracts
         run: |
-          node config/scripts/ensure-native-runtime.mjs --runtime=node
           pnpm exec vitest run --config config/vitest.config.ts \
             src/main/daemon/shell-ready.test.ts \
             src/main/daemon/node-pty-fd-leak.test.ts \
@@ -172,7 +167,7 @@ jobs:
 
       - uses: ./.github/actions/install-node-dependencies
         with:
-          ignore-scripts: 'true'
+          native-runtime: node
 
       - name: Install Electron package binary for tests
         run: node config/scripts/install-electron-package-binary.mjs
@@ -198,10 +193,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ./.github/actions/install-node-dependencies
-        with:
-          ignore-scripts: 'true'
-
       - name: Cache electron-builder downloads
         uses: actions/cache@v5
         with:
@@ -212,16 +203,17 @@ jobs:
           restore-keys: |
             electron-builder-linux-
 
-      # Native preparation does not touch the bundle output directories.
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: electron
+
       - name: Build package inputs
         run: |
-          pnpm run ensure:electron-runtime &
-          pids=("$!")
-
           status=0
           pnpm run build:cli || status=1
 
           scripts=(build:relay build:electron-vite:parallel)
+          pids=()
           for script in "${scripts[@]}"; do
             pnpm run "$script" &
             pids+=("$!")