perf(ci): cache everything, unserialize typecheck, fan out the archive probes

.github/actionlint.yaml

@@ -0,0 +1,7 @@
+# Blacksmith runner labels. actionlint only knows the GitHub-hosted set, so without
+# this every `runs-on:` in the repo reports as an unknown label and drowns out real
+# findings. Add new sizes here when a job starts using one.
+self-hosted-runner:
+    labels:
+        - blacksmith-4vcpu-ubuntu-2404
+        - blacksmith-8vcpu-ubuntu-2404

.github/actions/bun-install/action.yml

@@ -0,0 +1,25 @@
+name: bun install
+description: >-
+    Frozen-lockfile install, shared by every CI job so there is one place to
+    change install behaviour.
+
+    Deliberately NOT cached. ~/.bun/install/cache for this repo is ~739MB, and
+    caching it measured consistently SLOWER than a cold install: knip's install
+    went 34s -> 57s and local-checkpoint-native's 44s -> 113s, because restoring
+    and re-saving that much data costs more than bun spends fetching. Do not
+    re-add actions/cache here without measuring the step both ways. If this
+    becomes a bottleneck the thing to try is a Blacksmith sticky disk mounted at
+    node_modules, which avoids the tarball round-trip entirely.
+
+inputs:
+    working-directory:
+        description: Directory holding the bun.lock to install from.
+        required: false
+        default: "."
+
+runs:
+    using: composite
+    steps:
+        - run: bun install --frozen-lockfile
+          shell: bash
+          working-directory: ${{ inputs.working-directory }}

.github/workflows/cleanup-preview-orphans.yml

@@ -39,6 +39,7 @@ concurrency:
 jobs:
     sweep:
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 20
         # ⚠️ STOPGAP. This job borrows `pr-preview` purely to shape its Infisical
         # OIDC subject — it deploys nothing and reads no environment secrets.
         #

.github/workflows/deploy-pr-preview.yml

@@ -22,6 +22,7 @@ jobs:
     deploy-pr-preview:
         if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 45
         # `pr-preview` environment must require manual approval in repo settings.
         # This blocks PR-controlled code (install scripts, build steps) from
         # accessing Infisical secrets until a maintainer reviews the diff.

.github/workflows/deploy-prd.yml

@@ -1,9 +1,13 @@
 name: Deploy PRD (Cloudflare via Alchemy)
 
+# Gated on CI rather than `push: main`. Both used to fire on the same push with
+# separate concurrency groups, so a red CI still shipped to production.
+# `workflow_dispatch` stays as the manual escape hatch and skips the gate.
 on:
-    push:
-        branches:
-            - main
+    workflow_run:
+        workflows: ["CI"]
+        types: [completed]
+        branches: [main]
     workflow_dispatch:
 
 concurrency:
@@ -17,16 +21,23 @@ permissions:
 jobs:
     deploy-prd:
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 30
+        # On a workflow_run event `github.sha` is the default branch head, not the
+        # commit CI actually ran against — so pin everything to head_sha, both for
+        # what gets deployed and for the telemetry stamp.
+        if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
         environment: production
         env:
             INFISICAL_ENV_SLUG: prod
             # Stamped onto deployed telemetry as `deployment.commit_sha` (server SDK
             # reads COMMIT_SHA; web build reads VITE_COMMIT_SHA via Vite define).
-            COMMIT_SHA: ${{ github.sha }}
-            VITE_COMMIT_SHA: ${{ github.sha }}
+            COMMIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+            VITE_COMMIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
         steps:
             - name: Checkout
               uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  ref: ${{ github.event.workflow_run.head_sha || github.ref }}
 
             - name: Setup mise (toolchain)
               uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4

.github/workflows/deploy-stg.yml

@@ -1,9 +1,11 @@
 name: Deploy STG (Cloudflare via Alchemy)
 
+# Gated on CI rather than `push: main` — see the note in deploy-prd.yml.
 on:
-    push:
-        branches:
-            - main
+    workflow_run:
+        workflows: ["CI"]
+        types: [completed]
+        branches: [main]
     workflow_dispatch:
 
 concurrency:
@@ -17,16 +19,20 @@ permissions:
 jobs:
     deploy-stg:
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 30
+        if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
         environment: staging
         env:
             INFISICAL_ENV_SLUG: staging
             # Stamped onto deployed telemetry as `deployment.commit_sha` (server SDK
             # reads COMMIT_SHA; web build reads VITE_COMMIT_SHA via Vite define).
-            COMMIT_SHA: ${{ github.sha }}
-            VITE_COMMIT_SHA: ${{ github.sha }}
+            COMMIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+            VITE_COMMIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
         steps:
             - name: Checkout
               uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  ref: ${{ github.event.workflow_run.head_sha || github.ref }}
 
             - name: Setup mise (toolchain)
               uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4

.github/workflows/eval.yml

@@ -40,6 +40,7 @@ jobs:
             github.event_name == 'workflow_dispatch' ||
             contains(github.event.pull_request.labels.*.name, 'run-evals')
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 30
         steps:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 

.github/workflows/ingest-load-tests.yml

@@ -35,6 +35,7 @@ jobs:
     load:
         name: OTLP protobuf load test
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 45
         defaults:
             run:
                 working-directory: apps/ingest

.github/workflows/ingest-rust-tests.yml

@@ -38,6 +38,7 @@ jobs:
     test:
         name: Cargo test and load benchmark
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 45
         defaults:
             run:
                 working-directory: apps/ingest
@@ -57,14 +58,14 @@ jobs:
               run: |
                   set +e
                   set -o pipefail
-                  cargo test 2>&1 | tee "$RUNNER_TEMP/ingest-cargo-test.txt"
+                  cargo test --locked 2>&1 | tee "$RUNNER_TEMP/ingest-cargo-test.txt"
                   echo "${PIPESTATUS[0]}" > "$RUNNER_TEMP/ingest-cargo-test.exit"
                   exit 0
 
             - name: Build PR ingest and benchmark binaries
               run: |
                   set +e
-                  cargo build --release --bin maple-ingest --bin load_test 2>&1 | tee "$RUNNER_TEMP/ingest-head-build.txt"
+                  cargo build --locked --release --bin maple-ingest --bin load_test 2>&1 | tee "$RUNNER_TEMP/ingest-head-build.txt"
                   echo "${PIPESTATUS[0]}" > "$RUNNER_TEMP/ingest-head-build.exit"
                   mkdir -p "$RUNNER_TEMP/head"
                   if [ -x target/release/maple-ingest ]; then
@@ -122,14 +123,23 @@ jobs:
                   # branch (it's added by the PR that introduces the harness).
                   # The probe + benchmark steps always use the head's load_test
                   # binary pointed at the base's maple-ingest.
+                  #
+                  # Build into the head's target dir rather than the worktree's own.
+                  # Swatinem/rust-cache only covers `workspaces: apps/ingest`, so a
+                  # worktree-local target/ under $RUNNER_TEMP was a full cold compile
+                  # of every dependency on every PR. Sharing the dir reuses those
+                  # cached dep artifacts and recompiles only what actually differs.
+                  # Safe because the head binaries were already copied to
+                  # $RUNNER_TEMP/head above, so overwriting target/release is fine.
                   (
                     cd "$RUNNER_TEMP/base/apps/ingest"
-                    cargo build --release --bin maple-ingest
+                    CARGO_TARGET_DIR="$GITHUB_WORKSPACE/apps/ingest/target" \
+                      cargo build --locked --release --bin maple-ingest
                   ) 2>&1 | tee "$RUNNER_TEMP/ingest-base-build.txt"
                   echo "${PIPESTATUS[0]}" > "$RUNNER_TEMP/ingest-base-build.exit"
                   mkdir -p "$RUNNER_TEMP/base-bin"
-                  if [ -x "$RUNNER_TEMP/base/apps/ingest/target/release/maple-ingest" ]; then
-                    cp "$RUNNER_TEMP/base/apps/ingest/target/release/maple-ingest" "$RUNNER_TEMP/base-bin/maple-ingest"
+                  if [ -x "$GITHUB_WORKSPACE/apps/ingest/target/release/maple-ingest" ]; then
+                    cp "$GITHUB_WORKSPACE/apps/ingest/target/release/maple-ingest" "$RUNNER_TEMP/base-bin/maple-ingest"
                   fi
                   exit 0
 

.github/workflows/local-binary-release.yml

@@ -40,6 +40,7 @@ jobs:
     build:
         name: Build ${{ matrix.target }}
         runs-on: ${{ matrix.runner }}
+        timeout-minutes: 60
         strategy:
             fail-fast: false
             matrix:

.github/workflows/otel-collector-maple-tests.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
     test:
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 15
         defaults:
             run:
                 working-directory: packages/otel-collector-maple-exporter

.github/workflows/publish-k8s-infra-chart.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
     publish:
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 15
         environment: publish-charts
         steps:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/publish-maple-otel-chart.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
     publish:
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 15
         environment: publish-charts
         steps:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/publish-otel-collector-maple.yml

@@ -23,6 +23,7 @@ env:
 jobs:
     publish:
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 45
         environment: publish-images
         steps:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/pullfrog.yml

@@ -22,6 +22,7 @@ permissions:
 jobs:
     pullfrog:
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 30
         # `pullfrog-agent` environment must require manual approval in repo
         # settings. The agent action receives a prompt that influences code
         # execution with repo write + many provider API keys, so dispatch

.github/workflows/tinybird-cd.yml

@@ -22,6 +22,7 @@ jobs:
     cd:
         name: Deploy (${{ matrix.target.label }})
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 30
         # One leg per long-lived Tinybird workspace. Each GitHub Environment supplies
         # its own TINYBIRD_HOST/TINYBIRD_TOKEN, so the matching workspace admin token
         # scopes each deploy to that workspace — no `--branch`/`__tb__` params needed.

.github/workflows/tinybird-ci.yml

@@ -11,6 +11,7 @@ permissions:
 jobs:
     ci:
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 30
         defaults:
             run:
                 working-directory: "."

.github/workflows/token-cost.yml

@@ -23,6 +23,7 @@ jobs:
     token-cost:
         name: Token Cost
         runs-on: blacksmith-4vcpu-ubuntu-2404
+        timeout-minutes: 20
         steps:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
               with:

apps/alerting/alchemy.run.ts

@@ -1,4 +1,5 @@
 import path from "node:path"
+import type { Output } from "alchemy"
 import * as Cloudflare from "alchemy/Cloudflare"
 import * as Effect from "effect/Effect"
 import * as Redacted from "effect/Redacted"
@@ -38,8 +39,12 @@ export interface CreateAlertingWorkerOptions {
 	 * error/anomaly/alert ticks all start investigations when an incident opens,
 	 * and `maybeEnqueueTriage` needs this binding to reach the agent — without it
 	 * every run is written straight to `failed` with `agent_unavailable`.
+	 *
+	 * `workerName` is an `Output` because it comes from a not-yet-applied worker
+	 * resource; the service binding below resolves it at apply time. Declaring it
+	 * as a bare `string` did not match what createChatFlueWorker actually returns.
 	 */
-	chatFlue: { workerName: string }
+	chatFlue: { workerName: string | Output<string> }
 }
 
 export const createAlertingWorker = ({ stage, mapleDb, chatFlue }: CreateAlertingWorkerOptions) =>

turbo.json

@@ -8,8 +8,14 @@
 			"dependsOn": ["^build"],
 			"outputs": ["dist/**", ".output/**"]
 		},
+		// Deliberately NOT `^typecheck`. Every package's typecheck is `tsc --noEmit`,
+		// which emits nothing a downstream task can consume, and no tsconfig here uses
+		// composite/references — so `^typecheck` was ordering-only and serialized a
+		// topological wave across ~26 packages. `^build` is the real edge: it produces
+		// the .d.mts for the four dist-pointing packages (effect-sdk, clickhouse-builder,
+		// alchemy-maple, browser). Re-add `^typecheck` only if TS project references land.
 		"typecheck": {
-			"dependsOn": ["^typecheck", "^build"]
+			"dependsOn": ["^build"]
 		},
 		"test": {
 			"dependsOn": ["^build"],