Menu

#514 perf(ci): sub-10-minute staging builds - warm cache on main, skip staging notarization

closed
nobody
None
2026-07-21
2026-07-21
Anonymous
No

Originally created by: adityaharishch

The problem, measured

On the last release (v1.72.0-staging.6, run 29812896206):

Step Time
Compile daemon + tray 1495s (~25 min)
Bundle + sign + notarize .app 79s
Everything else ~2 min

The cold compile is the build time. Notarization is rounding error.

Why it was cold every single time

release-build is tag-triggered, and GitHub scopes Actions caches by ref - a run restores only from its own ref or the default branch. Every release cuts a new tag, so the 1.45 GB cache saved under refs/heads/refs/tags/v1.72.0-staging.6 was unreachable from …staging.7. Nothing on main carried a release-shaped cache either. Result: 25 min of compiling, every build, forever.

Cache quota made it worse - the repo sat at 12.16 GB against a 10 GB limit, so GitHub was actively evicting. ~6.6 GB of obsolete Intel/Windows/universal caches have been deleted out-of-band.

The fix

  1. cache-warm.yml (new) - runs the same two cargo invocations as release-build's macOS job on push to main + nightly, saving macos-release-aarch64-apple-darwin under refs/heads/main. Tag builds restore from the default branch, so staging and production tags both start warm. Its compile step must stay in lockstep with release-build's or the cache silently stops matching.
  2. Staging skips notarization - Gatekeeper enforces notarization only on a quarantined app, and the quarantine flag is set by the browser that downloads it. Staging is delivered exclusively by tauri-plugin-updater, which unpacks the tarball itself and sets no flag, so the relaunched app is verified on its Developer ID signature (still unconditional) plus the updater's minisign key. Stable still fully notarizes - new users download that DMG in a browser.
  3. verify-release-bundle.sh - channel-aware: every signing assertion still runs on staging (a broken signature breaks the updater relaunch); only the notarized/stapled checks are skipped.

Expected result

Staging: ~25 min cold → target <10 min warm. Production is untouched by this PR.

Note

The warm cache only exists after cache-warm runs once on main. I'll dispatch it manually after merge rather than wait for the first nightly.

Related

Tickets: #515
Tickets: #516
Tickets: #528

Discussion

  • Anonymous

    Anonymous - 2026-07-21

    Originally posted by: coderabbitai[bot]

    [!IMPORTANT]

    Review skipped

    Auto reviews are disabled on base/target branches other than the default branch.

    Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.


    ⚙️ Run configuration

    Configuration used: Organization UI

    Review profile: ASSERTIVE

    Plan: Pro Plus

    Run ID: 14391d93-63fb-4b8b-89a5-add9108503ec

    You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

    Use the checkbox below for a quick retry:
    - [ ] 🔍 Trigger review

    ✨ Finishing Touches
    🧪 Generate unit tests (beta) - [ ] Create PR with unit tests - [ ] Commit unit tests in branch `perf/ci-warm-cache`

    Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

    ❤️ Share - [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

    Comment @coderabbitai help to get the list of available commands.

     
  • Anonymous

    Anonymous - 2026-07-21

    Ticket changed by: adityaharishch

    • status: open --> closed
     

Log in to post a comment.