ci: drop the e2e Turbopack dev cache and keep /ship's full test gate

Author: waleedlatif1

.agents/skills/ship/SKILL.md

@@ -42,7 +42,7 @@ When the user runs `/ship`:
   - If the diff modifies UI code (any non-test `.tsx` file, or anything under `apps/sim/components/`, `apps/sim/hooks/`, or `apps/sim/stores/`), run `/cleanup`. It fans out the React/UI passes (effects, memo, callbacks, state, React Query, emcn, url-state), the comment pass, and the test-audit pass, and applies fixes so they land in this commit.
   - Otherwise, if the diff adds or changes tests (`*.test.ts(x)`, `*.integration.ts`, `**/e2e/**`, `apps/sim/scripts/test-*-e2e.ts`), run `/test-audit audit <changed test files>` on its own. Every new or changed test must pass the authoring gate; delete the ones that don't rather than shipping them.
   - Then run the test files the diff adds or changes, plus the existing tests beside changed source files, with `bun run --cwd <workspace> test <paths>` (`bun run --cwd apps/sim test <paths>` for the app; `*.integration.ts` needs the setup in `.claude/rules/sim-testing.md`). A failing test aborts ship.
-  - Then run `bun run test:scripts` (the `scripts/*.test.ts` suite CI runs; workspace-scoped runs skip it, which is how a `scripts/check-*.test.ts` failure has reached CI) and the suites of the workspaces the change reaches: `bunx turbo run test --filter='...[origin/staging]'` (each changed workspace plus every workspace that depends on it). CI runs every suite, sharded, on every push; the full local suite needs more memory than a laptop reliably has and catches nothing CI does not. When the diff touches root test or build config (`vitest.shared.ts`, `turbo.json`, the root `package.json`, `bun.lock`), the filter selects nothing that config reaches, so run the full root `bun run test` instead. A failing test aborts ship.
+  - Then run root `bun run test` from the repo root. It chains `test:scripts` (the `scripts/*.test.ts` suite CI runs) before every workspace suite; workspace-scoped runs skip it, which is how a `scripts/check-*.test.ts` failure has reached CI. A failing test aborts ship.
 5. **Run migration safety** — only if the diff touches `packages/db/migrations/**` or `packages/db/schema.ts`:
   - Run `/db-migrate` to review the migration for zero-downtime safety (expand/contract phasing, backward-compatibility with the deployed app version).
   - `(cd packages/db && bunx drizzle-kit generate && git status --porcelain ./migrations)` must print nothing (CI's schema/migration sync step).

.github/actions/dev-cache/action.yml

@@ -10,13 +10,11 @@
 # the readiness deadline only has to catch a hung boot: an exited server fails immediately, and
 # either way the server log tail lands in the job log.
 #
-# Each group restores its own Turbopack dev cache (mounted by the dev-cache action, keyed by group
-# and by this file's hash, so a cache is only ever read under the NEXT_PUBLIC_* values it was
-# compiled with). The app is stopped with SIGINT so its last cache write completes: `next dev`
-# SIGKILLs its server 100ms after SIGTERM. A cache Turbopack reports as corrupt is dropped, and a
-# startup it aborted is retried once from an empty cache. The app runs in its own session under an
-# E2E_APP tag, and stop-session.sh returns only once every process in that session or carrying
-# that tag has exited (Next's telemetry flush runs detached and still writes .next/dev).
+# Each app starts from an empty Turbopack dev cache: a cache written under other NEXT_PUBLIC_*
+# values, by a server that `next dev` SIGKILLs 100ms after SIGTERM, can panic Turbopack or wedge a
+# route compile on restore. It runs in its own session under an E2E_APP tag, and stop-session.sh
+# returns only once every process in that session or carrying that tag has exited (Next's
+# telemetry flush runs detached and still writes .next/dev).
 set -euo pipefail
 
 group=${1:?usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|mobile>}
@@ -29,35 +27,11 @@ app_tag=''
 server_log=''
 status_log=''
 
-cache_broken() {
-  grep -qiE 'cache corruption|turbopack.*panic|panicked' "$server_log" 2>/dev/null
-}
-
-# The cache directory is a mount point: empty it rather than remove it.
-clear_cache() {
-  local cache="$GITHUB_WORKSPACE/apps/sim/.next/dev"
-  [ -d "$cache" ] || return 0
-  find "$cache" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
-}
-
-# SIGINT is best-effort; the cleanup always runs, since workers and the detached telemetry flush
-# can outlive a server that has already exited.
-stop_app() {
-  if kill -INT "$server_pid" 2>/dev/null; then
-    for _ in $(seq 1 30); do kill -0 "$server_pid" 2>/dev/null || break; sleep 1; done
-  fi
-  bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$app_tag"
-}
-
 finish() {
   local status=$?
   if [ -n "$server_pid" ]; then
-    stop_app || status=1
+    bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$app_tag" || status=1
     wait "$server_pid" 2>/dev/null || true
-    if cache_broken; then
-      echo "::warning::Turbopack reported a broken dev cache; clearing it for the next run."
-      clear_cache
-    fi
     if [ -n "$status_log" ]; then
       awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$status_log"
     fi
@@ -69,13 +43,6 @@ finish() {
 }
 trap finish EXIT
 
-# launch_app <port>
-launch_app() {
-  E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
-    --port "$1" > "$server_log" 2>&1 &
-  server_pid=$!
-}
-
 # start_app <name> <port> <label> [record-http-status]
 start_app() {
   local name=$1 port=$2 label=$3
@@ -87,21 +54,14 @@ start_app() {
   export NEXT_PUBLIC_APP_URL="http://127.0.0.1:$port"
   export BETTER_AUTH_URL="$NEXT_PUBLIC_APP_URL"
   export DISABLE_TELEMETRY=true NEXT_TELEMETRY_DISABLED=1
-  launch_app "$port"
+  rm -rf .next/dev
+  E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
+    --port "$port" > "$server_log" 2>&1 &
+  server_pid=$!
 
-  local started=$SECONDS retried=false
+  local started=$SECONDS
   until curl --fail --silent --max-time 10 "$NEXT_PUBLIC_APP_URL/api/health" > /dev/null; do
     if ! kill -0 "$server_pid" 2>/dev/null; then
-      if [ "$retried" = false ] && cache_broken; then
-        echo "::warning::Turbopack rejected the restored dev cache; restarting from an empty cache."
-        tail -n 50 "$server_log"
-        stop_app
-        clear_cache
-        retried=true
-        launch_app "$port"
-        started=$SECONDS
-        continue
-      fi
       echo "::error::Local $label app exited during startup."
       exit 1
     fi

.github/scripts/http-e2e.sh

@@ -201,14 +201,6 @@ jobs:
         working-directory: packages/db
         run: bun run db:migrate
 
-      # One cache per group: each group's app runs under its own fixed NEXT_PUBLIC_* values.
-      - name: Mount Turbopack dev cache
-        uses: ./.github/actions/dev-cache
-        with:
-          provider: ${{ vars.CI_PROVIDER }}
-          name: e2e-${{ matrix.group }}
-          env-hash: ${{ hashFiles('.github/scripts/http-e2e.sh') }}
-
       # No step timeout: the job's bound covers a hang without cutting a slow but healthy suite
       # short of writing its report.
       - name: Run end-to-end suites
@@ -301,13 +293,21 @@ jobs:
         run: bun run db:migrate
 
       # Turbopack's dev cache turns the spec's route warm-up from a cold compile (~4 min) into a
-      # restore.
+      # restore. It is content-addressed, so a pull request's changed modules still recompile; the
+      # key carries the installed Next version so an upgrade starts from an empty cache, and the
+      # event and fork segments keep untrusted runs off the cache trusted runs read.
+      - name: Resolve Turbopack dev cache key
+        id: next-cache
+        run: echo "key=${GITHUB_REPOSITORY}-next-dev-desktop-live-${GITHUB_EVENT_NAME}${FORK_SUFFIX}-$(jq -r .version node_modules/next/package.json)" >> "$GITHUB_OUTPUT"
+        env:
+          FORK_SUFFIX: ${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
+
       - name: Mount Turbopack dev cache
-        uses: ./.github/actions/dev-cache
+        uses: ./.github/actions/cache
         with:
           provider: ${{ vars.CI_PROVIDER }}
-          name: desktop-live
-          env-hash: ${{ hashFiles('.github/workflows/checks.yml') }}
+          key: ${{ steps.next-cache.outputs.key }}
+          path: ./apps/sim/.next/dev
 
       # Chat switches, Stop, sign-out, approval, the dormant-executor round trip, and background
       # runs across a chat switch and a network cut. The spec runs the recording proxy (the app's