mirror of
https://github.com/home-assistant/frontend.git
synced 2026-08-20 21:28:22 +01:00
5f007a1575
* Run the frontend build in parallel with lint and tests The build job waited for lint and test because a full build was expensive enough that we did not want to spend it on a PR that fails its checks. With the rspack persistent cache it now takes ~3 min instead of ~5, and it is the longest job in the run, so serialising it behind the others dominates CI wall-clock: 8s + max(lint 86s, test 123s) + build 194s. Depend only on prepare-dependencies so all three run together, which brings a successful run down from ~5.5 min to ~3.5 min — the build itself becomes the floor. To avoid finishing an expensive build for a PR that is already broken, each of the three jobs cancels the whole run when it fails. The cancel step needs `actions: write`; on pull requests from forks the token stays read-only, so it is a no-op there and the jobs just run to completion. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Keep the Actions write scope away from pull request code The cancellation needed `actions: write`, and granting it at workflow scope handed it to every job — including the ones that check out the pull request and pass GITHUB_TOKEN into the gulp build, so PR-controlled code (or a compromised dependency) would have had write access to Actions. Move the cancellation into its own job that holds `actions: write` on its own and never checks out the repository, so the elevated token is never exposed to PR code. It cannot simply `needs` the checks — a dependent job only starts once they have all finished, which is too late to cancel anything — so it polls the run's job statuses and cancels on the first failure. Costs one extra (idle) runner slot for the duration of the run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>