Miguel PalhasandClaude Opus 5
64d5829037
The `flake` job was the pipeline's critical path at ~9 minutes, all of it one cold `nix build`: with an empty /nix every run, it recompiled the whole release closure under `lto = "thin"` + `codegen-units = 1`. - Cache /nix across runs, keyed on the lockfiles the closure derives from, so crane's deps-only derivation survives and only maestro's own crates rebuild. Saved from pushes only, so a PR cannot write a partial store. - Build only `.#webFrontend` on PRs — that is the step that guards pnpmDeps.hash. The release binaries stay on main. - Replace the hand-rolled `target/` cache with Swatinem/rust-cache, which prunes to the current lockfile instead of accumulating stale artifacts behind a prefix restore-key. ~60s per run went into moving that entry. - Run tests under cargo-nextest, which parallelises across the 20 integration binaries. Capped at 4 threads in .config/nextest.toml: the tmux-backed tests starve each other at the num-cpus default and trip their 5s deadlines. - actions/setup-node instead of a second apt-get pass via nodesource. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>