The `flake` job was the pipeline's critical path at ~9 minutes, all of it
one cold `nix build`: with an empty /nix every run, it recompiled the whole
release closure under `lto = "thin"` + `codegen-units = 1`.
- Cache /nix across runs, keyed on the lockfiles the closure derives from,
so crane's deps-only derivation survives and only maestro's own crates
rebuild. Saved from pushes only, so a PR cannot write a partial store.
- Build only `.#webFrontend` on PRs — that is the step that guards
pnpmDeps.hash. The release binaries stay on main.
- Replace the hand-rolled `target/` cache with Swatinem/rust-cache, which
prunes to the current lockfile instead of accumulating stale artifacts
behind a prefix restore-key. ~60s per run went into moving that entry.
- Run tests under cargo-nextest, which parallelises across the 20
integration binaries. Capped at 4 threads in .config/nextest.toml: the
tmux-backed tests starve each other at the num-cpus default and trip
their 5s deadlines.
- actions/setup-node instead of a second apt-get pass via nodesource.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
