ci: seed hosted Linux packaging and mobile bundle caches on main, and stop PR-local saves (#34672)

- Warm electron-builder-linux-<versions> and the hosted ubuntu-24.04 Electron native modules
- PRs restore hosted Linux Electron native modules without saving
- Replace mobile verify's bundler-cache with a restore of a warmup-saved bundle
- Drop the pnpm store cache where a direct install was faster (mobile main, glibc-floor containers)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

.github/actions/prepare-native-runtime/action.yml

@@ -77,12 +77,13 @@ runs:
         ORCA_NATIVE_BUILD_DIRECTORIES
         ORCA_NATIVE_CACHE_PATHS
 
-    # The warmers seed every Windows image and runtime on main; PR copies were single-use 8-14 MB uploads.
+    # The warmers seed every Windows image and runtime, and hosted Linux Electron, on main; PR copies were single-use uploads.
     - name: Restore compiled native modules
       id: native-cache-restore
       if: >-
         inputs.native-runtime != 'none' && inputs.persist-native-cache != 'false' &&
-        !(github.event_name == 'pull_request' && runner.os == 'Windows')
+        !(github.event_name == 'pull_request' && (runner.os == 'Windows' ||
+        runner.os == 'Linux' && inputs.native-runtime == 'electron' && runner.environment == 'github-hosted'))
       uses: actions/cache@v5
       with:
         # Post-job saving cannot resolve nested composite step outputs.
@@ -97,7 +98,8 @@ runs:
       id: native-cache-restore-only
       if: >-
         inputs.native-runtime != 'none' && (inputs.persist-native-cache == 'false' ||
-        github.event_name == 'pull_request' && runner.os == 'Windows')
+        github.event_name == 'pull_request' && (runner.os == 'Windows' ||
+        runner.os == 'Linux' && inputs.native-runtime == 'electron' && runner.environment == 'github-hosted'))
       uses: actions/cache/restore@v5
       with:
         path: |

.github/workflows/ci-cache-warmup-platform-jobs.yml

@@ -180,6 +180,91 @@ jobs:
           native-runtime: electron
           cache-pnpm-store: 'false'
 
+  # Hosted Linux packaging and packaged-browser E2E restore these; PRs no longer save their own copies.
+  warm-linux-electron:
+    concurrency:
+      group: ci-cache-warmup-linux-electron-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: ${{ github.event_name != 'schedule' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: electron
+          cache-pnpm-store: 'false'
+
+      - name: Resolve electron-builder download versions
+        id: eb-versions
+        if: github.event_name != 'pull_request'
+        shell: bash
+        run: node -p "const d = require('./package.json').devDependencies; 'versions=electron' + d.electron + '-builder' + d['electron-builder']" >> "$GITHUB_OUTPUT"
+      # pr.yml package restores this exact path and key.
+      - name: Seed shared Linux packaging downloads
+        id: eb-cache
+        if: github.event_name != 'pull_request'
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/electron-builder
+          key: electron-builder-linux-${{ steps.eb-versions.outputs.versions }}
+          lookup-only: true
+      # The same toolsets electron-builder fetches for AppImage, deb and rpm.
+      - name: Download Linux packaging tools
+        if: github.event_name != 'pull_request' && steps.eb-cache.outputs.cache-hit != 'true'
+        run: >-
+          node -e "const linux = require('app-builder-lib/out/toolsets/linux.js');
+          const { getIconsToolsetPath } = require('app-builder-lib/out/toolsets/icons.js');
+          const { Arch } = require('builder-util');
+          const { toolsets } = require('./config/electron-builder-pr-linux.config.cjs');
+          (async () => { await getIconsToolsetPath(); await linux.getFpmPath();
+          await linux.getAppImageTools(toolsets.appimage, Arch.x64) })().catch((error) => { console.error(error); process.exit(1) })"
+
+  # Mobile verify restores this bundle on pull requests without saving.
+  warm-mobile-bundle:
+    if: github.event_name != 'pull_request'
+    concurrency:
+      group: ci-cache-warmup-mobile-bundle-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: ${{ github.event_name != 'schedule' }}
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 15
+    env:
+      BUNDLE_FROZEN: 'true'
+    defaults:
+      run:
+        working-directory: mobile
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          working-directory: mobile
+      - name: Resolve fastlane bundle cache
+        id: ruby-bundle
+        env:
+          GEMFILE_HASH: ${{ hashFiles('mobile/Gemfile', 'mobile/Gemfile.lock') }}
+        run: |
+          . /etc/os-release
+          printf 'key=mobile-bundle-v1-%s-%s-%s-%s\n' "$ID-$VERSION_ID" "$(ruby -e 'print RUBY_PLATFORM')" "$(ruby -e 'print RbConfig::CONFIG["ruby_version"]')" "$GEMFILE_HASH" >> "$GITHUB_OUTPUT"
+      - name: Seed fastlane bundle
+        id: ruby-bundle-cache
+        uses: actions/cache@v5
+        with:
+          path: mobile/vendor/bundle
+          key: ${{ steps.ruby-bundle.outputs.key }}
+          lookup-only: true
+      - name: Install fastlane
+        if: steps.ruby-bundle-cache.outputs.cache-hit != 'true'
+        run: |
+          bundle config set --local path "$PWD/vendor/bundle"
+          bundle config set --local deployment true
+          bundle install --jobs 4
+
   warm-linux-package-fixtures:
     if: github.event_name != 'pull_request'
     concurrency:

.github/workflows/ci-cache-warmup-platforms.yml

@@ -62,6 +62,8 @@ on:
       - 'config/scripts/build-windows-agent-hook.mjs'
       - 'config/scripts/windows-rust-executable-build.mjs'
       - 'resources/build/icon.ico'
+      - 'mobile/Gemfile'
+      - 'mobile/Gemfile.lock'
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
     paths:

.github/workflows/mobile.yml

@@ -141,20 +141,47 @@ jobs:
             echo 'should_run=true' >> "$GITHUB_OUTPUT"
           fi
 
-      # Bundler-cache proves the release’s pinned fastlane still resolves before a release needs it.
-      - name: Setup Ruby and fastlane
-        id: ruby-tools
+      - name: Setup Ruby
+        id: ruby-setup
         background: true
         if: steps.ruby-scope.outputs.should_run != 'false'
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: '3.3'
-          bundler-cache: true
           working-directory: mobile
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - wait: ruby-setup
+
+      # ruby/setup-ruby's bundler-cache saves on every miss; the platform warmup saves this key on main.
+      - name: Resolve fastlane bundle cache
+        id: ruby-bundle
+        if: steps.ruby-scope.outputs.should_run != 'false'
+        env:
+          GEMFILE_HASH: ${{ hashFiles('mobile/Gemfile', 'mobile/Gemfile.lock') }}
+        run: |
+          . /etc/os-release
+          printf 'key=mobile-bundle-v1-%s-%s-%s-%s\n' "$ID-$VERSION_ID" "$(ruby -e 'print RUBY_PLATFORM')" "$(ruby -e 'print RbConfig::CONFIG["ruby_version"]')" "$GEMFILE_HASH" >> "$GITHUB_OUTPUT"
+
+      - name: Restore fastlane bundle
+        if: steps.ruby-scope.outputs.should_run != 'false'
+        uses: actions/cache/restore@v5
+        with:
+          path: mobile/vendor/bundle
+          key: ${{ steps.ruby-bundle.outputs.key }}
+
+      # Installing proves the release’s pinned fastlane still resolves before a release needs it.
+      - name: Install fastlane
+        id: ruby-tools
+        background: true
+        if: steps.ruby-scope.outputs.should_run != 'false'
+        run: |
+          bundle config set --local path "$PWD/vendor/bundle"
+          bundle config set --local deployment true
+          bundle install --jobs 4
+
       # Check mobile import cycles after Expo deps install; pre-install pr.yml cannot load its tsconfig.
       - name: Lint mobile imports with mobile dependencies installed
         working-directory: .
@@ -298,8 +325,10 @@ jobs:
         with:
           persist-credentials: false
 
+      # Restoring the 650 MB store took longer than downloading these packages.
       - uses: ./.github/actions/install-node-dependencies
         with:
+          cache-pnpm-store: 'false'
           cache-dependency-path: |
             pnpm-lock.yaml
             mobile/pnpm-lock.yaml

.github/workflows/node-server-tests.yml

@@ -409,7 +409,10 @@ jobs:
           persist-credentials: false
       - name: Trust the checked-out workspace
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      # A direct install (6-9s) beats restoring the 417 MB store plus a linking install.
       - uses: ./.github/actions/install-node-dependencies
+        with:
+          cache-pnpm-store: 'false'
       - name: Build and smoke this runner's node-pty prebuild slot under the pinned Node
         run: |
           pnpm build:orcad-prebuilds

.github/workflows/pr.yml

@@ -1042,11 +1042,18 @@ jobs:
         with:
           persist-credentials: false
 
+      # Electron and builder releases fix what this downloads; the lockfile churns far more often.
+      - name: Resolve electron-builder download versions
+        id: eb-versions
+        shell: bash
+        run: node -p "const d = require('./package.json').devDependencies; 'versions=electron' + d.electron + '-builder' + d['electron-builder']" >> "$GITHUB_OUTPUT"
+
+      # The platform warmup seeds this on main.
       - name: Cache electron-builder downloads
         uses: actions/cache/restore@v5
         with:
           path: ~/.cache/electron-builder
-          key: electron-builder-linux-${{ hashFiles('pnpm-lock.yaml') }}
+          key: electron-builder-linux-${{ steps.eb-versions.outputs.versions }}
           restore-keys: |
             electron-builder-linux-
 

.github/workflows/release-cut.yml

@@ -1217,7 +1217,7 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ~/.cache/electron-builder
-          key: electron-builder-linux-${{ hashFiles('pnpm-lock.yaml') }}
+          key: electron-builder-linux-${{ steps.eb-versions.outputs.versions }}
           # The release cache above restores the same tools, so this only needs to save on a miss.
           lookup-only: true