chore(ci): optimize CI caching, concurrency, and Tauri security - #937
Merged
Conversation
Address multiple CI/CD efficiency and security gaps identified during project optimization analysis. The changes reduce PR build times, prevent wasteful concurrent runs, tighten the Tauri security boundary, and eliminate unnecessary submodule fetches on non-macOS jobs. CI workflow improvements: - Add swatinem/rust-cache@v2 to both ci.yml jobs (android-check and cross-platform), matching the caching already present in release-tauri.yml. This converts PR Rust compilation from full rebuilds to incremental builds, saving an estimated 60-80% of compile time per run. - Add concurrency groups to all three workflows. PR pushes cancel superseded runs to free concurrency slots; tag pushes and manual dispatches are isolated by run_id to avoid mutually canceling release builds. Previously, rapid PR pushes triggered redundant parallel CI runs with no cancellation. - Unify Node version to 22 across release-tauri.yml and android-apk.yml, which were previously pinned to 20. This ensures consistent build environments across all workflows. Submodule and security hardening: - Conditionally fetch the vendor/qwen-asr submodule only on macOS jobs across all three workflows. The submodule is compiled exclusively by build.rs on macOS (build_qwen_asr_macos); Linux, Windows, and Android builds never reference it. Removing the unconditional recursive checkout eliminates a network fetch and a submodule-availability failure point on every non-macOS job. - Set withGlobalTauri to false in tauri.conf.json. The frontend exclusively uses @tauri-apps/api imports and never references the window.__TAURI__ global, so disabling it removes an unnecessary XSS attack surface without functional impact. Dependency hygiene: - Move @types/dompurify from dependencies to devDependencies in package.json. Type declaration packages are build-time only and should not ship in the production bundle.
lispking
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Address CI/CD efficiency, release-safety, dependency-metadata, and Tauri API-surface gaps identified during project optimization analysis. The changes reduce repeated PR work, prevent stale tag builds from publishing release artifacts, tighten the Tauri frontend API surface, and eliminate unnecessary submodule fetches on non-macOS jobs.
CI workflow improvements:
Submodule and Tauri hardening:
Dependency hygiene:
Regression coverage: