feat(ci): cache npm tarballs and supersede in-flight PR runs - #68
Merged
Conversation
- cache: npm + cache-dependency-path on all 8 setup-node steps in reusable-ci — restores ~/.npm keyed on the lockfile hash; npm ci still wipes node_modules and verifies lockfile integrity hashes, so the merge-gate guarantee is unchanged. Release path stays uncached. - concurrency group in the ci.yml stub: rapid successive pushes cancel superseded runs instead of burning 4 duplicate jobs to completion.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
There was a problem hiding this comment.
Pull request overview
This PR optimizes CI runtime across the fleet by enabling npm tarball caching in the reusable CI workflow and by adding workflow-level concurrency to CI stubs so new pushes supersede in-flight PR runs.
Changes:
- Add
concurrencyto theci.ymlworkflow stub to cancel in-progress CI runs on rapid successive PR pushes. - Enable
actions/setup-nodenpm caching (keyed bypackage-lock.json) across all Node setup steps inreusable-ci.yml. - Document caching policy in the reusable CI workflow header (including the explicit non-cached release workflow policy).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| workflow-stubs/ci.yml | Adds workflow-level concurrency so newer PR pushes cancel older in-flight CI runs. |
| .github/workflows/reusable-ci.yml | Enables npm cache usage on all setup-node steps and documents the caching policy. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
19
to
20
| permissions: | ||
| contents: read |
Comment on lines
+4
to
+8
| # Caching policy: every setup-node step caches ~/.npm keyed on the lockfile | ||
| # hash. This only changes where npm ci fetches tarballs from — node_modules | ||
| # is still wiped and rebuilt, and npm ci still verifies every package | ||
| # against the lockfile's integrity hashes, so the lockfile-integrity | ||
| # guarantee this workflow exists for is untouched. Lockfile-bump PRs are |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Minutes-reduction batch (amended version of the caching plan drafted 2026-07-29).
npm caching —
cache: 'npm'+cache-dependency-path: package-lock.jsonon all 8 setup-node steps in reusable-ci. Caches~/.npmonly:npm clean-installstill wipesnode_modulesand validates every package against the lockfile's integrity hashes, so the lockfile-integrity gate is untouched — the cache only changes where tarballs come from. All 25 repos have lockfiles (verified fleet-wide), so the setup-node lockfile requirement introduces no new failure mode. Lockfile-bump PRs (Renovate weekly / lockfile maintenance) are cold by definition.reusable-releasedeliberately stays uncached — pristine publish path (policy now documented in the header).Concurrency — the ci.yml stub gains
concurrency: ci-${{ github.ref }}withcancel-in-progress: true: rapid successive pushes to a PR supersede in-flight runs instead of running duplicate 4-job CI to completion (review finding L-18). Lives in the stub because workflow-level concurrency in a called workflow is not applied. Fans out via sync.Rollout: merge → sync wave → canary on a nswds-email draft PR run twice (expect a "Cache restored from key" log + shorter install on run 2, and run 1 cancelled by run 2's push) → promote v1 via the Promote v1 workflow.