improvement(ci): fix the stripe-sync flake, stop helm cancelling a publish, attest via actions/attest (#8873)

* improvement(ci): halve the mobile job, narrow the desktop gate, skip proven checks on main, fix the top flake

- e2e (mobile): Chromium and WebKit run as two processes against one app instead of back to back
  (each seeds its own fixtures and writes its own report), and every e2e group restores its own
  Turbopack dev cache. The job was the PR critical path at ~19.5 min: Chromium's pass (718 s
  median) carried the cold compile and WebKit waited it out (310 s). `suite setup` failures are
  now logged instead of only reaching the uploaded report.
- dev-cache action: one mount shared by desktop-live and the e2e groups, keyed by app, event,
  fork, Next version and the hash of the file that sets the app's environment, so a cache is never
  read under NEXT_PUBLIC_* values it was not compiled with. http-e2e.sh stops apps with SIGINT so
  the cache write completes, drops a cache Turbopack reports as corrupt, and retries a startup it
  aborted once from an empty cache.
- desktop-live-changes.sh: run the live desktop suite when a pull request touches a path it
  exercises instead of skipping only docs-like paths. Every genuine desktop-live failure since the
  layout change was on a PR the new rule still runs; pushes always run it.
- ci.yml: a `proof` job lets a main push skip the checks when it is a merge whose tree is
  identical to its staging parent and a staging push run of that parent passed `checks / ci`;
  migrate gates on that proof instead. Any other shape or any error runs the full checks.
- codeql, helm, desktop-e2e skip the staging -> main release PR (main's push and schedule still
  run them); helm never cancels a push mid-publish; trigger-promote on 2 vCPU; attestations via
  actions/attest with artifact-metadata: write.
- stripe-sync-convergence: start each contender only after the parked transaction holds its locks,
  wait on a deadline rather than 200 polls, and release the transaction before failing, so a lost
  race no longer hangs the suite's teardown. It was the most frequent flake (9 red runs).
- Integration shard weights refreshed from a recent run; /ship runs the affected workspaces' suites
  instead of the full suite locally.

* ci: include the chat page in the desktop gate, scope release-PR skips to this repository, give a cache-retry boot the full deadline

* ci: keep the release PR's CodeQL scan, require the main base for release-PR skips, gate desktop-live on workspace permissions

* ci: keep the desktop live gate's skip-only-unrelated rule

* ci: run the mobile browsers one after the other again

* ci: drop the e2e Turbopack dev cache and keep /ship's full test gate

* ci: drop the main proof job and the release-PR skips

Author: waleedlatif1

.github/workflows/ci.yml

@@ -564,7 +564,8 @@ jobs:
       needs.promote.result == 'success' &&
       needs.trigger-upload.result == 'success' &&
       needs.promote.outputs.promoted == 'true'
-    runs-on: *runner-4vcpu
+    # Mostly waiting on the ECS cutover after a dependency install: the smallest runner is enough.
+    runs-on: *runner-2vcpu
     # Leave setup/promotion headroom above the 70-minute cutover poll.
     timeout-minutes: 90
     permissions:
@@ -992,6 +993,8 @@ jobs:
       # Sigstore signs against the runner's OIDC identity; no key material is stored.
       id-token: write
       attestations: write
+      # Records each attestation against the image as an artifact storage record.
+      artifact-metadata: write
     strategy:
       fail-fast: false
       matrix:
@@ -1031,7 +1034,7 @@ jobs:
 
       - name: Attest SBOM
         if: matrix.platform != 'index'
-        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ matrix.image }}
           subject-digest: ${{ matrix.digest }}
@@ -1041,7 +1044,7 @@ jobs:
           push-to-registry: true
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ matrix.image }}
           subject-digest: ${{ matrix.digest }}

.github/workflows/helm.yml

@@ -24,9 +24,11 @@ on:
       - 'scripts/generate-image-manifest.ts'
       - 'package.json'
 
+# Pull requests cancel a superseded run; pushes never do, so a newer push cannot cut off a chart
+# publish already in flight.
 concurrency:
   group: helm-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
@@ -260,7 +262,8 @@ jobs:
       contents: read # Read the chart source.
       packages: write # Push the chart, its signature, and its attestations to GHCR.
       id-token: write # Sigstore signs against the runner's OIDC identity; no key material is stored.
-      attestations: write # Let actions/attest-build-provenance record the SLSA provenance.
+      attestations: write # Let actions/attest record the SLSA provenance.
+      artifact-metadata: write # And its artifact storage record.
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
@@ -388,7 +391,7 @@ jobs:
       # attestation with it, rather than only being retrievable from GitHub.
       - name: Attest build provenance
         if: steps.exists.outputs.already == 'false'
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ steps.package.outputs.repository }}
           subject-digest: ${{ steps.push.outputs.digest }}

apps/sim/lib/billing/webhooks/stripe-sync-convergence.integration.ts

@@ -15,6 +15,7 @@ import {
   type InMemoryStripe,
   stripeClientMock,
 } from '@sim/testing/mocks/stripe.mock'
+import { sleep } from '@sim/utils/helpers'
 import { generateId } from '@sim/utils/id'
 import { type BetterAuthOptions, betterAuth } from 'better-auth'
 import { createAuthMiddleware } from 'better-auth/api'
@@ -376,7 +377,11 @@ type TestTransaction = Parameters<Parameters<typeof testDatabase.transaction>[0]
 
 /**
  * Starts a transaction that takes its locks in `holdLocks`, then parks until released and runs
- * `finish`. `untilBlocking` resolves once another backend is waiting on one of its locks.
+ * `finish`. `locked` resolves once those locks are held: start the contending work after it, or the
+ * contender can take the lock first and nothing ever waits on the parked transaction.
+ * `untilBlocking` resolves once another backend is waiting on one of its locks; if none does within
+ * the deadline it releases the transaction before throwing, so a failure never leaves it holding
+ * locks that the suite's teardown then waits on.
  */
 function startParkedTransaction(
   holdLocks: (tx: TestTransaction) => Promise<void>,
@@ -399,16 +404,18 @@ function startParkedTransaction(
   })
   async function untilBlocking() {
     const pid = await holderPid
-    for (let attempt = 0; attempt < 200; attempt++) {
+    const deadline = Date.now() + 10_000
+    while (Date.now() < deadline) {
       const [row] = await connection<{ blocked: number }[]>`
         select count(*)::int as blocked from pg_stat_activity
         where ${pid}::int = any(pg_blocking_pids(pid))`
       if (row.blocked > 0) return
-      await new Promise<void>((resolve) => setImmediate(resolve))
+      await sleep(10)
     }
+    release()
     throw new Error('No transaction ever waited on the parked one')
   }
-  return { done, release, untilBlocking }
+  return { done, release, locked: holderPid.then(() => undefined), untilBlocking }
 }
 
 describe('cancel_at_period_end sync', () => {
@@ -1037,6 +1044,7 @@ describe('Team activation', () => {
         reason: 'admin-cancel-at-period-end',
       })
     })
+    await cancelling.locked
     const activating = testDatabase.transaction((tx) =>
       ensureTeamOrganizationForAcceptance({
         billingOwnerUserId: owner.id,
@@ -1088,6 +1096,7 @@ describe('operator retry', () => {
         })
       }
     )
+    await writing.locked
     const requeuing = requeueFromAdminApi(pauseSync)
     await writing.untilBlocking()
     writing.release()
@@ -1129,6 +1138,7 @@ describe('operator retry', () => {
         })
       }
     )
+    await writing.locked
     const retrying = requestDashboardSubscriptionCancellation({
       organizationId: org.organizationId,
       operationId,

apps/sim/scripts/test-mobile-e2e.ts

@@ -1151,6 +1151,7 @@ try {
     durationMs: 0,
     error: getErrorMessage(error),
   })
+  logger.error('FAIL suite setup', { error: getErrorMessage(error) })
 } finally {
   await check('fixtures are removed', undefined, async () => {
     await sql.begin(async (tx) => {