[mbianchidev]

Summary

• Reuse one locked installation and runner for the full Pages coverage suite and its subsequent build. Deployment still requires successful tests/build and the existing environment.
• Let the shared Electron build perform the single locked server install, and key the npm download cache with both lockfiles.
• Download the three release artifacts concurrently, retain separate architecture directories and fail on missing artifacts or digest mismatches. Use compression level 0 for macOS payloads and level 1 for Windows archives, which also contain unpacked executables.
• Add optional build_only inputs for Release and Pages. Defaults remain false; validation uses isolated concurrency and skips publication/deployment. Release sources still come from the exact verified existing tag.

Coverage of every remaining workflow

Workflow	Result
release.yml	Removed redundant setup, tuned artifact transfer and added nonpublishing validation. Retained macOS arm64/x64 and Windows x64, signing hooks, checksums, manifest guards and retry behavior.
deploy.yml	Combined sequential test/build jobs without dropping tests, coverage or the deployment environment; added build-only validation.
version-bump.yml	Audited with auto-release.sh, version scripts and their synthetic integration tests. Its 9-12 second preparation job, full-history checkout, serialization, source/version ordering and atomic pushes are deliberately unchanged.

Independent branch from main, not stacked on #368. No changes to tests.yml, either lockfile, settings, secrets, strict ready-only policies, production versions or tags.

Measured performance and limits

Baseline: three comparable recent main runs, including Pages 39831367373, 39681819473, 39632333151, and their automatic-release counterparts.

Work	Historical observations	This build-only validation
Release downloads	18/66/77s sequentially	15s concurrently
macOS arm64 upload	13/15/20s	7s
macOS x64 upload	12/13/16s	5s
Windows upload	11/15/15s	8s
Pages test + build job execution	106/133/134s across two jobs	132s in one job

The redundant Pages installation alone previously took 5-9 seconds; it is gone, but this single cold-cache run does not establish an overall Pages latency improvement. Release timings are one nonpublishing validation versus historical samples, not a controlled repeated benchmark. Publication/deployment steps were skipped and runner queueing differs, so total workflow wall times are not compared as equivalent workloads. Warm-cache speedup and billed-cost savings remain unmeasured; the public-repository billing API reports zero billable milliseconds.

Local three-sample archive measurements on real payloads support the compression choices:

Archive	Compression	Median archive time	Size tradeoff
macOS arm64 DMG/ZIP/blockmaps, about 407 MB	6 to 0	7.556s to 0.210s	+0.27%
Existing Windows release payloads, about 424 MB	6 to 1	19.444s to 6.012s	+3.71%

Validation

• Current-head PR CI passed, including 1,560 renderer tests, 43 browser regressions and the no-cache Docker health check. No review comments or unresolved review threads at handoff.
• Release build-only passed macOS arm64/x64 and Windows x64, all three artifact digest checks, manifest merging and staged-asset verification. Release-note generation and release creation were skipped. Existing v2.4.8 tag identity, release timestamps and every asset ID/digest were unchanged before/after.
• Pages build-only passed the full coverage suite and production site build, uploaded its artifact and skipped deployment.
• Local Node 22.23.4 validation passed a cold-cache locked install, 1,560 renderer tests in 117 files, 366 backend tests in 27 files, Pages build, normal installation and arm64 DMG/ZIP packaging with --publish never and no signing/publication credentials. Verified the ad-hoc signature, packaged architecture/backend metadata, the actual packaged SQLite binary with an in-memory Electron query, and payload checksums.
• actionlint including shellcheck passed on all three workflows. Real old/new staging scripts produced byte-identical synthetic outputs; each missing artifact and missing manifest payload still failed.

Release build-only uses application/build-script sources from the existing tag, not this workflow branch. The changed locked server-install script was validated locally; hosted tag builds do not claim to validate that branch-only script. Automatic version preparation was exercised only with isolated synthetic repositories, never a production bump.

Existing warnings and constraints

• ci: avoid redundant test runners and Electron setup #368 merged during this work and contains the compatible advisory fixes. PR merge-check installations include it and report zero vulnerabilities. Local/branch-only Pages validation and existing-tag release validation still use the older lockfiles: 5 root advisories (3 high, 2 moderate) and 3 backend advisories (2 high, 1 moderate). No duplicate remediation or modification of published tags was made here.
• Existing release configuration has no Developer ID/Windows signing certificate and macOS notarization is disabled. The existing ad-hoc signing hook is retained; no credentials or signing policy were changed.
• GitHub reports the ubuntu-latest migration to Ubuntu 26. This is a runner-image notice, not a failing check.