From c925ea530ba8df6072df66212dcc507b1ab122ef Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:00:58 +0000
Subject: [PATCH 01/10] Run push-triggered CI only on master

Every push to a same-repo pull request branch triggered both a push run
and a pull_request run of the test, format, and flake check workflows,
doubling CI load for no extra signal. The duplicated runs saturate the
runner concurrency pool and queue other workflows behind them; job
start delays of up to nine minutes were observed on the C# native
build matrix.

Restrict push events to master. Pull requests keep their pull_request
runs, and master pushes still produce the Test, Lint, and Format check
runs that the release workflow's wait-for-ci step polls for. Release
tags are verified to be ancestors of origin/master before publishing,
so tagged commits always carry those check runs.
---
 .github/workflows/flake-check.yml | 2 ++
 .github/workflows/format.yml      | 6 +++++-
 .github/workflows/rust.yml        | 9 ++++++++-
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/flake-check.yml b/.github/workflows/flake-check.yml
index b642adb0e..38025108f 100644
--- a/.github/workflows/flake-check.yml
+++ b/.github/workflows/flake-check.yml
@@ -1,7 +1,9 @@
 name: Flake Check
 
+# See rust.yml for why push events are restricted to master.
 on:
   push:
+    branches: [master]
   pull_request:
     types: [opened, synchronize, reopened]
     paths-ignore:
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 08c56b316..5394cc511 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -1,6 +1,10 @@
 name: Continuous integration
 
-on: [push, pull_request]
+# See rust.yml for why push events are restricted to master.
+on:
+  push:
+    branches: [master]
+  pull_request:
 
 jobs:
   Format:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 5c3bb758f..6a31ddbbb 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -1,6 +1,13 @@
 name: Continuous integration
 
-on: [push, pull_request]
+# Pull requests from branches in this repository would otherwise trigger
+# both a push and a pull_request run for every commit; restricting push
+# events to master keeps one run per change while still producing the
+# master check runs the release workflow waits on.
+on:
+  push:
+    branches: [master]
+  pull_request:
 
 jobs:
   Test:

From 88db4cea62313cad448383e0855cf630fa2892ad Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:01:06 +0000
Subject: [PATCH 02/10] Give the format workflow a distinct name

Both format.yml and rust.yml were named "Continuous integration", so
the run list showed two indistinguishable workflows and anything keyed
on the workflow name, such as the concurrency groups introduced next,
would conflate them. Branch protection and the release workflow match
on the Format job name, which is unchanged.
---
 .github/workflows/format.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 5394cc511..291accb56 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -1,4 +1,4 @@
-name: Continuous integration
+name: Format
 
 # See rust.yml for why push events are restricted to master.
 on:

From 0ad2f833f45be7fee62b414a6f8a1c69ea972d34 Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:01:25 +0000
Subject: [PATCH 03/10] Cancel superseded pull request CI runs

Without concurrency groups, pushing a new commit to a pull request
leaves the previous commit's runs executing to completion. Those
obsolete runs occupy the shared runner pool and queue the new runs and
other workflows behind them.

Group runs per workflow and pull request and cancel the old run when a
new one starts. Other events (master pushes, tags, schedules,
workflow_run) use the unique run id as their group so they are never
cancelled or serialized.
---
 .github/workflows/csharp.yml        | 7 +++++++
 .github/workflows/dart.yml          | 7 +++++++
 .github/workflows/flake-check.yml   | 7 +++++++
 .github/workflows/format.yml        | 7 +++++++
 .github/workflows/javascript.yml    | 7 +++++++
 .github/workflows/python.yml        | 7 +++++++
 .github/workflows/release-image.yml | 7 +++++++
 .github/workflows/rust.yml          | 7 +++++++
 8 files changed, 56 insertions(+)

diff --git a/.github/workflows/csharp.yml b/.github/workflows/csharp.yml
index 2374d1ec1..fe015d1c3 100644
--- a/.github/workflows/csharp.yml
+++ b/.github/workflows/csharp.yml
@@ -13,6 +13,13 @@ on:
       - flake.nix
       - flake.lock
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-csharp-and-test-unix:
     name: "Build and test csharp"
diff --git a/.github/workflows/dart.yml b/.github/workflows/dart.yml
index 115af707b..ccbc5f824 100644
--- a/.github/workflows/dart.yml
+++ b/.github/workflows/dart.yml
@@ -13,6 +13,13 @@ on:
       - flake.nix
       - flake.lock
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-dart-and-test:
     name: "Build and test dart"
diff --git a/.github/workflows/flake-check.yml b/.github/workflows/flake-check.yml
index 38025108f..ec65a6224 100644
--- a/.github/workflows/flake-check.yml
+++ b/.github/workflows/flake-check.yml
@@ -9,6 +9,13 @@ on:
     paths-ignore:
       - "flake.lock"
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   flake-check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 291accb56..4365115b6 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -6,6 +6,13 @@ on:
     branches: [master]
   pull_request:
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   Format:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/javascript.yml b/.github/workflows/javascript.yml
index c116525ca..b9f5eab02 100644
--- a/.github/workflows/javascript.yml
+++ b/.github/workflows/javascript.yml
@@ -13,6 +13,13 @@ on:
       - flake.nix
       - flake.lock
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-js-and-test:
     name: "Build and test javascript"
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index f66644b9a..17303154c 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -13,6 +13,13 @@ on:
       - flake.nix
       - flake.lock
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-python-and-test:
     name: "Build and test python"
diff --git a/.github/workflows/release-image.yml b/.github/workflows/release-image.yml
index 64a46c340..f061e017a 100644
--- a/.github/workflows/release-image.yml
+++ b/.github/workflows/release-image.yml
@@ -9,6 +9,13 @@ on:
       - payjoin-mailroom-[0-9]*
   workflow_dispatch:
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   publish:
     name: "Build and publish Docker image"
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 6a31ddbbb..9f298d972 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -9,6 +9,13 @@ on:
     branches: [master]
   pull_request:
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   Test:
     runs-on: ubuntu-latest

From 5fd41c87fd7692b806f090c6c1c7e86255ab8ce4 Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:01:36 +0000
Subject: [PATCH 04/10] Run diff mutants only on pull requests

github.base_ref is only set for pull_request events. On push events
the job diffed against an empty ref, producing an empty diff, so
cargo-mutants had nothing to do and the job spent a runner slot doing
setup work for no signal.
---
 .github/workflows/rust.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 9f298d972..9a582c2b1 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -115,6 +115,9 @@ jobs:
 
   DiffMutants:
     name: Diff cargo-mutants
+    # The diff is taken against the pull request base branch; on other
+    # events base_ref is empty and the job mutates an empty diff.
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     env:
       RUSTUP_TOOLCHAIN: stable

From 2b8958ccb1785896650beab0d8e249a961fdae71 Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:01:52 +0000
Subject: [PATCH 05/10] Key native asset build caches by RID

All six build-nuget-native matrix legs computed the same rust-cache
key: the job id, toolchain, and lockfiles are identical and the cross
target is passed on the command line, outside the key. The legs raced
to save one cache entry, only the first finisher (typically the fast
linux-x64 build) won, and every other leg, including the 16 to 19
minute Windows cross builds, ran cold on every workflow run.

Add the RID to the cache key so each leg keeps its own dependency
cache, and cache cargo-xwin's MSVC CRT/SDK download alongside it.
---
 .github/workflows/csharp.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/csharp.yml b/.github/workflows/csharp.yml
index fe015d1c3..ddc93cdcf 100644
--- a/.github/workflows/csharp.yml
+++ b/.github/workflows/csharp.yml
@@ -118,6 +118,14 @@ jobs:
 
       - name: Use cache
         uses: Swatinem/rust-cache@v2
+        with:
+          # rust-cache derives its key from the job id, toolchain, and
+          # lockfiles, all identical across this matrix, so without an
+          # explicit key the six RIDs race for one cache entry and only
+          # the first finisher's target directory is ever stored.
+          key: ${{ matrix.rid }}
+          # cargo-xwin downloads the MSVC CRT/SDK here on every cold run.
+          cache-directories: ~/.cache/cargo-xwin
 
       - name: Install cross toolchain
         # Version- and hash-pinned: these tools produce the shipped binaries.

From e8e2e93395d38f08ee333ac908db612fce6291ff Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:02:26 +0000
Subject: [PATCH 06/10] Seed native asset build caches from master

The C# workflow only ran on pull requests, and GitHub Actions caches
saved on a pull request branch are not visible to other pull requests.
Even with per-RID cache keys, every new pull request therefore started
the 16 to 19 minute Windows cross builds from a cold cache.

Run build-nuget-native on master pushes that touch payjoin-ffi so its
caches land on the default branch, where every pull request can restore
them. This also verifies the cross builds post-merge. The test, pack,
and smoke jobs are skipped on push since their coverage is already
provided pre-merge.
---
 .github/workflows/csharp.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.github/workflows/csharp.yml b/.github/workflows/csharp.yml
index ddc93cdcf..e1fe9f0d5 100644
--- a/.github/workflows/csharp.yml
+++ b/.github/workflows/csharp.yml
@@ -12,6 +12,15 @@ on:
       # the flake change this workflow's environment.
       - flake.nix
       - flake.lock
+  # GitHub Actions caches saved on a pull request branch are invisible to
+  # other pull requests; only caches saved on master are shared. Run the
+  # native asset builds on master so every pull request starts from a warm
+  # cross-compilation cache, and so cross-build breakage is caught after
+  # merge. The test, pack, and smoke jobs stay pull-request-only.
+  push:
+    branches: [master]
+    paths:
+      - payjoin-ffi/**
 
 # Pushing a new commit makes any still-running workflow for the same pull
 # request obsolete; cancel it instead of letting it occupy runners. Other
@@ -23,6 +32,9 @@ concurrency:
 jobs:
   build-csharp-and-test-unix:
     name: "Build and test csharp"
+    # Cache seeding on master pushes only needs build-nuget-native; see the
+    # push trigger comment above.
+    if: github.event_name != 'push'
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -41,6 +53,9 @@ jobs:
 
   build-csharp-and-test-windows:
     name: "Build and test csharp (windows)"
+    # Cache seeding on master pushes only needs build-nuget-native; see the
+    # push trigger comment above.
+    if: github.event_name != 'push'
     runs-on: windows-latest
     env:
       RUSTUP_TOOLCHAIN: 1.85
@@ -168,6 +183,9 @@ jobs:
 
   pack-nuget:
     name: "Pack C# NuGet package"
+    # Cache seeding on master pushes only needs build-nuget-native; see the
+    # push trigger comment above.
+    if: github.event_name != 'push'
     runs-on: ubuntu-latest
     needs: build-nuget-native
     env:

From 86900431960a712df82830f11794d6eaa3b5db18 Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:03:25 +0000
Subject: [PATCH 07/10] Save Rust build caches only from master

The repository sits at 12 GB of Actions cache against GitHub's 10 GB
budget, so entries are constantly evicted. Most of the space is
per-branch duplicates: every pull request branch saves its own copy of
the ~1.5 GB per-toolchain Test caches that already exist for master,
and those duplicates evict smaller caches such as the C# native build
entries, forcing cold 16 to 19 minute cross builds.

Save rust-cache entries only from master, which every pull request can
restore. DiffMutants runs only on pull requests, so instead of saving
anything it now restores the stable Test cache via a shared key.
---
 .github/workflows/csharp.yml |  4 ++++
 .github/workflows/rust.yml   | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/.github/workflows/csharp.yml b/.github/workflows/csharp.yml
index e1fe9f0d5..eed606777 100644
--- a/.github/workflows/csharp.yml
+++ b/.github/workflows/csharp.yml
@@ -141,6 +141,10 @@ jobs:
           key: ${{ matrix.rid }}
           # cargo-xwin downloads the MSVC CRT/SDK here on every cold run.
           cache-directories: ~/.cache/cargo-xwin
+          # Pull request branch caches are invisible to other pull requests
+          # and would duplicate the master entries within the repository's
+          # 10 GB cache budget; only the master seeding runs save.
+          save-if: ${{ github.event_name == 'push' }}
 
       - name: Install cross toolchain
         # Version- and hash-pinned: these tools produce the shipped binaries.
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 9a582c2b1..9e4dce863 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -51,6 +51,13 @@ jobs:
           echo "$(nix build .#nginx-with-stream --print-out-paths --no-link)/bin" >> $GITHUB_PATH
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # Caches saved on a pull request branch are visible only to that
+          # pull request and duplicate the master entry; with three
+          # toolchains at ~1.5 GB each they overflow the repository's 10 GB
+          # cache budget and evict other workflows' caches. Save only from
+          # master, which every branch can restore.
+          save-if: ${{ github.ref == 'refs/heads/master' }}
       - name: Run tests
         run: RUST_LOG=debug bash contrib/test.sh
 
@@ -61,6 +68,13 @@ jobs:
         uses: actions/checkout@v6
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # Caches saved on a pull request branch are visible only to that
+          # pull request and duplicate the master entry; with three
+          # toolchains at ~1.5 GB each they overflow the repository's 10 GB
+          # cache budget and evict other workflows' caches. Save only from
+          # master, which every branch can restore.
+          save-if: ${{ github.ref == 'refs/heads/master' }}
       - name: "Install nix"
         uses: DeterminateSystems/determinate-nix-action@main
       - name: "Use nix cache"
@@ -97,6 +111,13 @@ jobs:
           echo "$(nix build .#nginx-with-stream --print-out-paths --no-link)/bin" >> $GITHUB_PATH
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # Caches saved on a pull request branch are visible only to that
+          # pull request and duplicate the master entry; with three
+          # toolchains at ~1.5 GB each they overflow the repository's 10 GB
+          # cache budget and evict other workflows' caches. Save only from
+          # master, which every branch can restore.
+          save-if: ${{ github.ref == 'refs/heads/master' }}
       - name: "Install cargo-llvm-cov"
         uses: taiki-e/install-action@cargo-llvm-cov
       - name: "Generate code coverage for tests"
@@ -139,6 +160,13 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # This job only runs on pull requests, so it can never save a
+          # cache that other branches could see. Restore the stable Test
+          # job's master cache instead of keeping a per-branch copy; both
+          # jobs build the workspace with the stable toolchain.
+          shared-key: Test
+          save-if: false
       - name: Run cargo-mutants on diff
         run: >
           cargo mutants --no-shuffle --in-diff git.diff
@@ -160,5 +188,12 @@ jobs:
         uses: dtolnay/rust-toolchain@nightly
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
+        with:
+          # Caches saved on a pull request branch are visible only to that
+          # pull request and duplicate the master entry; with three
+          # toolchains at ~1.5 GB each they overflow the repository's 10 GB
+          # cache budget and evict other workflows' caches. Save only from
+          # master, which every branch can restore.
+          save-if: ${{ github.ref == 'refs/heads/master' }}
       - name: "Build fuzz targets"
         run: cd fuzz && cargo build

From 2574753dc265035b279398db270d6158d899d717 Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:03:40 +0000
Subject: [PATCH 08/10] Run flake checks on PRs only for nix changes

Each flake-check run rebuilds the vendored dependencies and the whole
workspace from scratch in four matrix legs of 13 to 18 minutes,
because no nix binary cache is configured for this workflow. Three of
the legs then run the same workspace test suite that rust.yml has
already run on the pull request, and the maintenance leg repeats the
Lint and Format jobs. The nix-specific signal is only exercised when
the nix packaging inputs change.

Limit pull request runs to changes in nix files, the flake lock, the
cargo lockfiles, and the toolchain file. This also fixes the previous
paths-ignore, which skipped the flake checks on exactly the pull
requests that only touched flake.lock, where they matter most. Master
pushes still run the full check on every change, so a Rust-only change
that breaks the nix build is caught after merge rather than never.
---
 .github/workflows/flake-check.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/flake-check.yml b/.github/workflows/flake-check.yml
index ec65a6224..07a8be5bd 100644
--- a/.github/workflows/flake-check.yml
+++ b/.github/workflows/flake-check.yml
@@ -6,8 +6,18 @@ on:
     branches: [master]
   pull_request:
     types: [opened, synchronize, reopened]
-    paths-ignore:
+    # The msrv, stable, and nightly checks run the same workspace test
+    # suite that rust.yml already runs on every pull request, and the
+    # maintenance check duplicates the Lint and Format jobs. The signal
+    # unique to this workflow is that the nix packaging itself still
+    # works, so on pull requests it only runs when nix-relevant inputs
+    # change. Master pushes always run the full check.
+    paths:
+      - "**/*.nix"
       - "flake.lock"
+      - "Cargo-minimal.lock"
+      - "Cargo-recent.lock"
+      - "rust-toolchain.toml"
 
 # Pushing a new commit makes any still-running workflow for the same pull
 # request obsolete; cancel it instead of letting it occupy runners. Other

From 46d3913c74b408fd74bb88a711ccd918b97ced10 Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:03:51 +0000
Subject: [PATCH 09/10] Drop --verbose from cargo test invocations

cargo's --verbose flag prints every rustc and test-binary invocation:
in a passing CI Test job it accounted for roughly 6,900 of 9,600 log
lines while adding nothing to failure diagnosis. Failure detail is
unaffected: the test harness still captures per-test output, including
the RUST_LOG=debug tracing output, and prints it only when a test
fails.
---
 payjoin-cli/contrib/test.sh      | 2 +-
 payjoin-ffi/contrib/test.sh      | 2 +-
 payjoin-mailroom/contrib/test.sh | 4 ++--
 payjoin/contrib/test.sh          | 8 ++++----
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/payjoin-cli/contrib/test.sh b/payjoin-cli/contrib/test.sh
index d59518991..5fe025593 100755
--- a/payjoin-cli/contrib/test.sh
+++ b/payjoin-cli/contrib/test.sh
@@ -1,4 +1,4 @@
 #!/usr/bin/env bash
 set -e
 
-cargo test --locked --package payjoin-cli --verbose --all-features
+cargo test --locked --package payjoin-cli --all-features
diff --git a/payjoin-ffi/contrib/test.sh b/payjoin-ffi/contrib/test.sh
index 19689fa69..5950484cd 100755
--- a/payjoin-ffi/contrib/test.sh
+++ b/payjoin-ffi/contrib/test.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -e
 cd "$(dirname "$0")/.."
-cargo test --package payjoin-ffi --verbose --features=_manual-tls,_test-utils
+cargo test --package payjoin-ffi --features=_manual-tls,_test-utils
 BINDINGS="dart javascript python csharp"
 pids=()
 tmpfiles=()
diff --git a/payjoin-mailroom/contrib/test.sh b/payjoin-mailroom/contrib/test.sh
index 8faaff83f..ae39d5f0b 100755
--- a/payjoin-mailroom/contrib/test.sh
+++ b/payjoin-mailroom/contrib/test.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 set -e
 
-cargo test --locked --package payjoin-mailroom --verbose --all-features --lib
-cargo test --locked --package payjoin-mailroom --verbose --all-features --test integration
+cargo test --locked --package payjoin-mailroom --all-features --lib
+cargo test --locked --package payjoin-mailroom --all-features --test integration
diff --git a/payjoin/contrib/test.sh b/payjoin/contrib/test.sh
index 190dcae9a..1bb7a0910 100755
--- a/payjoin/contrib/test.sh
+++ b/payjoin/contrib/test.sh
@@ -3,10 +3,10 @@ set -e
 
 features=("v1" "v2")
 
-cargo test --locked --package payjoin --verbose --all-features --lib
-cargo test --locked --package payjoin --verbose --all-features --test integration
+cargo test --locked --package payjoin --all-features --lib
+cargo test --locked --package payjoin --all-features --test integration
 
 for feature in "${features[@]}"; do
-    cargo test --locked --package payjoin --verbose --no-default-features --features "$feature" --lib --no-run
-    cargo test --locked --package payjoin --verbose --no-default-features --features "$feature" --test integration --no-run
+    cargo test --locked --package payjoin --no-default-features --features "$feature" --lib --no-run
+    cargo test --locked --package payjoin --no-default-features --features "$feature" --test integration --no-run
 done

From 425c5410d8043bb1fba052440519c40eac0885fa Mon Sep 17 00:00:00 2001
From: spacebear <git@spacebear.dev>
Date: Mon, 3 Aug 2026 19:04:17 +0000
Subject: [PATCH 10/10] Update actions to their current major versions

Bump actions/checkout v6 to v7, actions/upload-artifact v4 to v7,
actions/download-artifact v4 to v8, actions/setup-python v5 to v7,
actions/setup-dotnet v4 to v6, and peter-evans/create-pull-request v7
to v8. Per their release notes these majors only move the actions to
the Node 24 runtime and ESM, which GitHub-hosted runners already
support; artifacts are downloaded by name here, so the download v5
path change for by-id downloads does not apply, and v8's
digest-mismatch enforcement is a hardening we want.

Also align the two lewagon/wait-on-check-action pins on v1.9.0, which
release-image.yml still used at v1.5.0.
---
 .github/workflows/crates-release.yml         | 16 ++++++-------
 .github/workflows/cron-directory-monitor.yml |  2 +-
 .github/workflows/cron-weekly-mutants.yml    |  4 ++--
 .github/workflows/csharp.yml                 | 24 ++++++++++----------
 .github/workflows/dart.yml                   |  2 +-
 .github/workflows/flake-check.yml            |  2 +-
 .github/workflows/flake-maintenance.yml      |  4 ++--
 .github/workflows/format.yml                 |  2 +-
 .github/workflows/javascript.yml             |  2 +-
 .github/workflows/lock-maintenance.yml       |  4 ++--
 .github/workflows/python.yml                 |  2 +-
 .github/workflows/release-image.yml          |  8 +++----
 .github/workflows/rust.yml                   | 14 ++++++------
 .github/workflows/standup-compile.yml        |  4 ++--
 .github/workflows/standup-on-comment.yml     |  4 ++--
 .github/workflows/standup-prompt.yml         |  4 ++--
 16 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/.github/workflows/crates-release.yml b/.github/workflows/crates-release.yml
index a6bf2310c..9a5ae4afe 100644
--- a/.github/workflows/crates-release.yml
+++ b/.github/workflows/crates-release.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Install nix
@@ -50,7 +50,7 @@ jobs:
       prerelease: ${{ steps.meta.outputs.prerelease }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Fetch master
@@ -112,7 +112,7 @@ jobs:
       VERSION: ${{ needs.verify-tag.outputs.version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install toolchain
         uses: dtolnay/rust-toolchain@stable
       - name: Use cache
@@ -133,7 +133,7 @@ jobs:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
         run: cargo publish --locked -p "$CRATE"
       - name: Upload packaged crate
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: crate
           path: target/package/${{ needs.verify-tag.outputs.crate }}-${{ needs.verify-tag.outputs.version }}.crate
@@ -150,13 +150,13 @@ jobs:
       VERSION: ${{ needs.verify-tag.outputs.version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install nix
         uses: DeterminateSystems/determinate-nix-action@main
       - name: Use nix cache
         uses: DeterminateSystems/magic-nix-cache-action@main
       - name: Download packaged crate
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: crate
           path: dist
@@ -193,13 +193,13 @@ jobs:
       VERSION: ${{ needs.verify-tag.outputs.version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install nix
         uses: DeterminateSystems/determinate-nix-action@main
       - name: Use nix cache
         uses: DeterminateSystems/magic-nix-cache-action@main
       - name: Download packaged crate
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: crate
           path: dist
diff --git a/.github/workflows/cron-directory-monitor.yml b/.github/workflows/cron-directory-monitor.yml
index 15e63110e..615e414b7 100644
--- a/.github/workflows/cron-directory-monitor.yml
+++ b/.github/workflows/cron-directory-monitor.yml
@@ -6,6 +6,6 @@ jobs:
   health-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check /health endpoint
         run: cd payjoin-mailroom && bash contrib/health-check.sh
diff --git a/.github/workflows/cron-weekly-mutants.yml b/.github/workflows/cron-weekly-mutants.yml
index 1e7ac721b..a5a9170d5 100644
--- a/.github/workflows/cron-weekly-mutants.yml
+++ b/.github/workflows/cron-weekly-mutants.yml
@@ -9,12 +9,12 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-mutants@27.1.0
       - run: cargo mutants --in-place --no-shuffle
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: mutants.out
diff --git a/.github/workflows/csharp.yml b/.github/workflows/csharp.yml
index eed606777..d6c62e6ea 100644
--- a/.github/workflows/csharp.yml
+++ b/.github/workflows/csharp.yml
@@ -41,7 +41,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"
@@ -64,7 +64,7 @@ jobs:
         working-directory: payjoin-ffi/csharp
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install Rust 1.85.0
         uses: dtolnay/rust-toolchain@1.85.0
 
@@ -72,7 +72,7 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
@@ -124,7 +124,7 @@ jobs:
             target: x86_64-pc-windows-msvc
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust 1.85.0
         uses: dtolnay/rust-toolchain@1.85.0
@@ -179,7 +179,7 @@ jobs:
           PAYJOIN_FFI_CROSS=1 PAYJOIN_FFI_RID=${{ matrix.rid }} bash ./scripts/build_nuget_native.sh
 
       - name: Upload NuGet native asset
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.rid }}
           path: payjoin-ffi/csharp/artifacts/runtimes/${{ matrix.rid }}/native/*
@@ -201,7 +201,7 @@ jobs:
         working-directory: payjoin-ffi/csharp
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust 1.85.0
         uses: dtolnay/rust-toolchain@1.85.0
@@ -210,12 +210,12 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Download native assets
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: payjoin-ffi/csharp/artifacts/downloaded
 
@@ -234,7 +234,7 @@ jobs:
         run: dotnet pack Payjoin.csproj --configuration Release --output artifacts/packages
 
       - name: Upload NuGet package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: payjoin-csharp-nuget-package
           path: payjoin-ffi/csharp/artifacts/packages/*.nupkg
@@ -264,15 +264,15 @@ jobs:
             rid: win-x64
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Download NuGet package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: payjoin-csharp-nuget-package
           path: payjoin-ffi/csharp/artifacts/packages
diff --git a/.github/workflows/dart.yml b/.github/workflows/dart.yml
index ccbc5f824..b8bb4a2c9 100644
--- a/.github/workflows/dart.yml
+++ b/.github/workflows/dart.yml
@@ -29,7 +29,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"
diff --git a/.github/workflows/flake-check.yml b/.github/workflows/flake-check.yml
index 07a8be5bd..a4ff24903 100644
--- a/.github/workflows/flake-check.yml
+++ b/.github/workflows/flake-check.yml
@@ -38,7 +38,7 @@ jobs:
           - maintenance
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/flake-maintenance.yml b/.github/workflows/flake-maintenance.yml
index e1d450cb1..ab9f0dcf9 100644
--- a/.github/workflows/flake-maintenance.yml
+++ b/.github/workflows/flake-maintenance.yml
@@ -16,7 +16,7 @@ jobs:
           - nightly
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -32,7 +32,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 4365115b6..c1b5e2b99 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Install nix"
         uses: DeterminateSystems/determinate-nix-action@main
       - name: "Use nix cache"
diff --git a/.github/workflows/javascript.yml b/.github/workflows/javascript.yml
index b9f5eab02..0bbba8fe3 100644
--- a/.github/workflows/javascript.yml
+++ b/.github/workflows/javascript.yml
@@ -29,7 +29,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"
diff --git a/.github/workflows/lock-maintenance.yml b/.github/workflows/lock-maintenance.yml
index 45e1b7e4b..8f3287e40 100644
--- a/.github/workflows/lock-maintenance.yml
+++ b/.github/workflows/lock-maintenance.yml
@@ -13,10 +13,10 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@nightly
       - run: bash contrib/update-lock-files.sh
-      - uses: peter-evans/create-pull-request@v7
+      - uses: peter-evans/create-pull-request@v8
         with:
           title: "chore: update cargo.lock"
           commit-message: "chore: update cargo.lock"
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 17303154c..400b20642 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -29,7 +29,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"
diff --git a/.github/workflows/release-image.yml b/.github/workflows/release-image.yml
index f061e017a..519ebb5ad 100644
--- a/.github/workflows/release-image.yml
+++ b/.github/workflows/release-image.yml
@@ -28,7 +28,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -58,14 +58,14 @@ jobs:
       packages: write
     steps:
       - name: Wait for other workflows
-        uses: lewagon/wait-on-check-action@v1.5.0
+        uses: lewagon/wait-on-check-action@v1.9.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           running-workflow-name: "Build and upload image artifact"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -83,7 +83,7 @@ jobs:
           ls -lh payjoin-mailroom-${TAG}.tar
 
       - name: Upload image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: payjoin-mailroom-image-${{ github.sha }}
           path: payjoin-mailroom-*.tar
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 9e4dce863..782d8edb1 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -34,7 +34,7 @@ jobs:
       RUSTUP_TOOLCHAIN: ${{ matrix.rust }}
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Install ${{ matrix.rust }} toolchain"
         uses: dtolnay/rust-toolchain@master
         with:
@@ -65,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -97,7 +97,7 @@ jobs:
       RUSTUP_TOOLCHAIN: stable
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Install toolchain"
         # rust-cache usage with stable Rust is most effective, as a cache is tied to the Rust version
         uses: dtolnay/rust-toolchain@stable
@@ -131,7 +131,7 @@ jobs:
     name: Code spell check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: codespell-project/actions-codespell@v2
 
   DiffMutants:
@@ -144,7 +144,7 @@ jobs:
       RUSTUP_TOOLCHAIN: stable
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # required for full diff context
       - name: Fetch base branch for diff
@@ -172,7 +172,7 @@ jobs:
           cargo mutants --no-shuffle --in-diff git.diff
           --test-tool=cargo --timeout=500 --build-timeout=500
       - name: Upload mutants.out
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: mutants-incremental-cargo.out
@@ -183,7 +183,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Install nightly toolchain"
         uses: dtolnay/rust-toolchain@nightly
       - name: "Use cache"
diff --git a/.github/workflows/standup-compile.yml b/.github/workflows/standup-compile.yml
index bd3f01849..992d429a6 100644
--- a/.github/workflows/standup-compile.yml
+++ b/.github/workflows/standup-compile.yml
@@ -10,8 +10,8 @@ jobs:
   compile:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install requests pyyaml
diff --git a/.github/workflows/standup-on-comment.yml b/.github/workflows/standup-on-comment.yml
index f244f8f99..4c7dcf181 100644
--- a/.github/workflows/standup-on-comment.yml
+++ b/.github/workflows/standup-on-comment.yml
@@ -14,8 +14,8 @@ jobs:
       contains(github.event.comment.body, '/check-in')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install requests pyyaml
diff --git a/.github/workflows/standup-prompt.yml b/.github/workflows/standup-prompt.yml
index 5d5056075..defac6f13 100644
--- a/.github/workflows/standup-prompt.yml
+++ b/.github/workflows/standup-prompt.yml
@@ -15,8 +15,8 @@ jobs:
   create-discussion:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install requests pyyaml