refactor(ci): extract preview release into separate workflow and fix native binary cache

.github/workflows/build-native-macos.yaml

@@ -214,7 +214,7 @@ jobs:
         continue-on-error: true  # cache key is immutable; fails harmlessly if already saved by a concurrent run
         with:
           path: packages/varlock/native-bins/darwin/VarlockEnclave.app
-          key: native-bin-macos-signed-${{ hashFiles('packages/encryption-binary-swift/swift/**') }}
+          key: native-bin-macos-signed-${{ hashFiles('packages/encryption-binary-swift/swift/Package.swift', 'packages/encryption-binary-swift/swift/Sources/**') }}
 
       - name: Cleanup signing keychain
         if: always()

.github/workflows/build-native-rust.yaml

@@ -19,6 +19,10 @@ on:
         description: 'Base name for uploaded artifacts (suffixed with platform)'
         type: string
         default: 'native-bin-rust'
+      source-hash:
+        description: 'Pre-computed hash of Rust source files (from Ubuntu runner). When provided, used for the binary cache key instead of local hashFiles to ensure cross-OS consistency.'
+        type: string
+        default: ''
 
 jobs:
   build:
@@ -214,4 +218,4 @@ jobs:
         continue-on-error: true  # cache key is immutable; fails harmlessly if already saved by a concurrent run
         with:
           path: packages/varlock/native-bins/${{ matrix.native-bin-subdir }}/
-          key: native-bin-rust-${{ matrix.native-bin-subdir }}-${{ hashFiles('packages/encryption-binary-rust/Cargo.lock', 'packages/encryption-binary-rust/src/**') }}
+          key: native-bin-rust-${{ matrix.native-bin-subdir }}-${{ inputs.source-hash || hashFiles('packages/encryption-binary-rust/Cargo.lock', 'packages/encryption-binary-rust/src/**') }}

.github/workflows/test.yaml

@@ -6,13 +6,19 @@ on:
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
     outputs:
+      includes-varlock: ${{ steps.check-release.outputs.includes-varlock }}
+      release-packages: ${{ steps.check-release.outputs.packages }}
       swift-changed: ${{ steps.check-swift.outputs.changed }}
       rust-changed: ${{ steps.check-rust.outputs.changed }}
+      swift-cache-hit: ${{ steps.swift-cache-check.outputs.cache-hit }}
+      rust-cache-hit: ${{ steps.rust-cache-final.outputs.cache-hit }}
+      rust-source-hash: ${{ steps.rust-hash.outputs.hash }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -55,42 +61,108 @@ jobs:
       - name: Run tests
         run: bun run test:ci
 
+      # Determine which packages will be preview-released (used to gate native builds)
+      - name: Check release packages
+        if: github.ref_name != 'main'
+        id: check-release
+        run: bun run scripts/check-release-packages.ts
+
       # Check if native binary source changed (used to gate native builds)
       - name: Check for Swift source changes
         id: check-swift
+        if: steps.check-release.outputs.includes-varlock == 'true'
         run: |
-          if git diff --name-only origin/main...HEAD | grep -q '^packages/encryption-binary-swift/'; then
+          if git diff --name-only origin/main...HEAD | grep -qE '^(packages/encryption-binary-swift/|\.github/workflows/build-native-macos\.yaml)'; then
             echo "changed=true" >> $GITHUB_OUTPUT
           else
             echo "changed=false" >> $GITHUB_OUTPUT
           fi
       - name: Check for Rust source changes
         id: check-rust
+        if: steps.check-release.outputs.includes-varlock == 'true'
         run: |
-          if git diff --name-only origin/main...HEAD | grep -q '^packages/encryption-binary-rust/'; then
+          if git diff --name-only origin/main...HEAD | grep -qE '^(packages/encryption-binary-rust/|\.github/workflows/build-native-rust\.yaml)'; then
             echo "changed=true" >> $GITHUB_OUTPUT
           else
             echo "changed=false" >> $GITHUB_OUTPUT
           fi
 
-  # Build + sign the macOS native binary if Swift source changed (warms the cache)
-  # this must be done on a mac-os runner
+      # Check if native binary caches exist (lookup-only, no download)
+      - name: Check Swift binary cache
+        id: swift-cache-check
+        if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-swift.outputs.changed != 'true'
+        uses: actions/cache/restore@v5
+        with:
+          path: packages/varlock/native-bins/darwin/VarlockEnclave.app
+          key: native-bin-macos-signed-${{ hashFiles('packages/encryption-binary-swift/swift/Package.swift', 'packages/encryption-binary-swift/swift/Sources/**') }}
+          lookup-only: true
+      # Compute Rust source hash once on Ubuntu — used for cache keys everywhere
+      # (hashFiles can differ across OSes, so we normalize it here)
+      - name: Compute Rust source hash
+        id: rust-hash
+        if: steps.check-release.outputs.includes-varlock == 'true'
+        run: |
+          HASH=${{ hashFiles('packages/encryption-binary-rust/Cargo.lock', 'packages/encryption-binary-rust/src/**') }}
+          echo "hash=$HASH" >> $GITHUB_OUTPUT
+      - name: Check Rust cache - linux-x64
+        id: rust-cache-check-linux-x64
+        if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-rust.outputs.changed != 'true'
+        uses: actions/cache/restore@v5
+        with:
+          path: packages/varlock/native-bins/linux-x64/
+          key: native-bin-rust-linux-x64-${{ steps.rust-hash.outputs.hash }}
+          lookup-only: true
+      - name: Check Rust cache - linux-arm64
+        id: rust-cache-check-linux-arm64
+        if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-rust.outputs.changed != 'true'
+        uses: actions/cache/restore@v5
+        with:
+          path: packages/varlock/native-bins/linux-arm64/
+          key: native-bin-rust-linux-arm64-${{ steps.rust-hash.outputs.hash }}
+          lookup-only: true
+      - name: Check Rust cache - win32-x64
+        id: rust-cache-check-win32-x64
+        if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-rust.outputs.changed != 'true'
+        uses: actions/cache/restore@v5
+        with:
+          path: packages/varlock/native-bins/win32-x64/
+          key: native-bin-rust-win32-x64-${{ steps.rust-hash.outputs.hash }}
+          lookup-only: true
+      - name: Determine Rust cache status
+        id: rust-cache-final
+        if: steps.check-release.outputs.includes-varlock == 'true' && steps.check-rust.outputs.changed != 'true'
+        run: |
+          if [[ "${{ steps.rust-cache-check-linux-x64.outputs.cache-hit }}" == "true" \
+             && "${{ steps.rust-cache-check-linux-arm64.outputs.cache-hit }}" == "true" \
+             && "${{ steps.rust-cache-check-win32-x64.outputs.cache-hit }}" == "true" ]]; then
+            echo "cache-hit=true" >> $GITHUB_OUTPUT
+          else
+            echo "cache-hit=false" >> $GITHUB_OUTPUT
+            echo "::warning::Some Rust binary caches missing — will trigger rebuild"
+          fi
+
+  # Build + sign the macOS native binary if varlock is being released AND (source changed or cache missing)
   build-native-macos:
     needs: build-and-test
-    if: needs.build-and-test.outputs.swift-changed == 'true'
+    if: >-
+      needs.build-and-test.outputs.includes-varlock == 'true'
+      && (needs.build-and-test.outputs.swift-changed == 'true' || needs.build-and-test.outputs.swift-cache-hit != 'true')
     uses: ./.github/workflows/build-native-macos.yaml
     with:
       artifact-name: native-bin-macos-ci
     secrets:
       OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
 
-  # Build Rust native binaries if source changed (warms the cache)
+  # Build Rust native binaries if varlock is being released AND (source changed or cache missing)
   build-native-rust:
     needs: build-and-test
-    if: needs.build-and-test.outputs.rust-changed == 'true'
+    if: >-
+      needs.build-and-test.outputs.includes-varlock == 'true'
+      && (needs.build-and-test.outputs.rust-changed == 'true' || needs.build-and-test.outputs.rust-cache-hit != 'true')
     uses: ./.github/workflows/build-native-rust.yaml
     with:
       artifact-name: native-bin-rust-ci
+      source-hash: ${{ needs.build-and-test.outputs.rust-source-hash }}
 
   # Publish preview packages via pkg-pr-new
   release-preview-packages:
@@ -120,28 +192,23 @@ jobs:
       - name: Enable turborepo build cache
         uses: rharkor/caching-for-turbo@v2.3.11
 
-      # Determine which packages will be preview-released
-      - name: Check release packages
-        id: check-release
-        run: bun run scripts/check-release-packages.ts
-
       # Get signed macOS .app if varlock is being released
-      # If the macOS build ran this run (swift changed), download the artifact directly
+      # If the macOS build ran this run, download the artifact directly
       # Otherwise, restore from cross-run cache
       - name: Download macOS native binary (from this run)
-        if: steps.check-release.outputs.includes-varlock == 'true' && needs.build-and-test.outputs.swift-changed == 'true'
+        if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-macos.result == 'success'
         uses: actions/download-artifact@v8
         with:
           name: native-bin-macos-ci
           path: packages/varlock/native-bins/darwin/VarlockEnclave.app
       - name: Restore cached macOS native binary (from prior run)
-        if: steps.check-release.outputs.includes-varlock == 'true' && needs.build-and-test.outputs.swift-changed != 'true'
+        if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-macos.result != 'success'
         uses: actions/cache/restore@v5
         with:
           path: packages/varlock/native-bins/darwin/VarlockEnclave.app
-          key: native-bin-macos-signed-${{ hashFiles('packages/encryption-binary-swift/swift/**') }}
+          key: native-bin-macos-signed-${{ hashFiles('packages/encryption-binary-swift/swift/Package.swift', 'packages/encryption-binary-swift/swift/Sources/**') }}
       - name: Verify and fix native binary permissions
-        if: steps.check-release.outputs.includes-varlock == 'true'
+        if: needs.build-and-test.outputs.includes-varlock == 'true'
         run: |
           BINARY=packages/varlock/native-bins/darwin/VarlockEnclave.app/Contents/MacOS/varlock-local-encrypt
           if [ ! -f "$BINARY" ]; then
@@ -153,15 +220,15 @@ jobs:
       # Get Rust native binaries if varlock is being released
       # If the Rust build ran this run, download the artifacts; otherwise restore from cache
       - name: Download Rust binaries (from this run)
-        if: steps.check-release.outputs.includes-varlock == 'true' && needs.build-and-test.outputs.rust-changed == 'true'
+        if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result == 'success'
         uses: actions/download-artifact@v8
         with:
           pattern: native-bin-rust-ci-*
           path: packages/varlock/native-bins/
           merge-multiple: false
       # Flatten: download-artifact creates subdirs per artifact name, but we need linux-x64/ etc.
       - name: Flatten Rust artifact directories (from this run)
-        if: steps.check-release.outputs.includes-varlock == 'true' && needs.build-and-test.outputs.rust-changed == 'true'
+        if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result == 'success'
         run: |
           cd packages/varlock/native-bins
           for dir in native-bin-rust-ci-*/; do
@@ -170,23 +237,23 @@ jobs:
           done
 
       - uses: actions/cache/restore@v5
-        if: steps.check-release.outputs.includes-varlock == 'true' && needs.build-and-test.outputs.rust-changed != 'true'
+        if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result != 'success'
         with:
           path: packages/varlock/native-bins/linux-x64/
-          key: native-bin-rust-linux-x64-${{ hashFiles('packages/encryption-binary-rust/Cargo.lock', 'packages/encryption-binary-rust/src/**') }}
+          key: native-bin-rust-linux-x64-${{ needs.build-and-test.outputs.rust-source-hash }}
       - uses: actions/cache/restore@v5
-        if: steps.check-release.outputs.includes-varlock == 'true' && needs.build-and-test.outputs.rust-changed != 'true'
+        if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result != 'success'
         with:
           path: packages/varlock/native-bins/linux-arm64/
-          key: native-bin-rust-linux-arm64-${{ hashFiles('packages/encryption-binary-rust/Cargo.lock', 'packages/encryption-binary-rust/src/**') }}
+          key: native-bin-rust-linux-arm64-${{ needs.build-and-test.outputs.rust-source-hash }}
       - uses: actions/cache/restore@v5
-        if: steps.check-release.outputs.includes-varlock == 'true' && needs.build-and-test.outputs.rust-changed != 'true'
+        if: needs.build-and-test.outputs.includes-varlock == 'true' && needs.build-native-rust.result != 'success'
         with:
           path: packages/varlock/native-bins/win32-x64/
-          key: native-bin-rust-win32-x64-${{ hashFiles('packages/encryption-binary-rust/Cargo.lock', 'packages/encryption-binary-rust/src/**') }}
+          key: native-bin-rust-win32-x64-${{ needs.build-and-test.outputs.rust-source-hash }}
 
       - name: Verify and fix Rust binary permissions
-        if: steps.check-release.outputs.includes-varlock == 'true'
+        if: needs.build-and-test.outputs.includes-varlock == 'true'
         run: |
           MISSING=()
           for SUBDIR in linux-x64 linux-arm64 win32-x64; do
@@ -208,12 +275,12 @@ jobs:
           fi
 
       - name: Build publishable npm packages
-        if: steps.check-release.outputs.packages != '[]'
+        if: needs.build-and-test.outputs.release-packages != '[]'
         run: bun run build:libs
         env:
           BUILD_TYPE: preview
       - name: Release preview packages
-        if: steps.check-release.outputs.packages != '[]'
+        if: needs.build-and-test.outputs.release-packages != '[]'
         run: bun run scripts/release-preview.ts
         env:
-          RELEASE_PACKAGES: ${{ steps.check-release.outputs.packages }}
+          RELEASE_PACKAGES: ${{ needs.build-and-test.outputs.release-packages }}