Ci optimization

.github/workflows/crates-release.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Install nix
@@ -50,7 +50,7 @@ jobs:
       prerelease: ${{ steps.meta.outputs.prerelease }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Fetch master
@@ -112,7 +112,7 @@ jobs:
       VERSION: ${{ needs.verify-tag.outputs.version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install toolchain
         uses: dtolnay/rust-toolchain@stable
       - name: Use cache
@@ -133,7 +133,7 @@ jobs:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
         run: cargo publish --locked -p "$CRATE"
       - name: Upload packaged crate
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: crate
           path: target/package/${{ needs.verify-tag.outputs.crate }}-${{ needs.verify-tag.outputs.version }}.crate
@@ -150,13 +150,13 @@ jobs:
       VERSION: ${{ needs.verify-tag.outputs.version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install nix
         uses: DeterminateSystems/determinate-nix-action@main
       - name: Use nix cache
         uses: DeterminateSystems/magic-nix-cache-action@main
       - name: Download packaged crate
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: crate
           path: dist
@@ -193,13 +193,13 @@ jobs:
       VERSION: ${{ needs.verify-tag.outputs.version }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install nix
         uses: DeterminateSystems/determinate-nix-action@main
       - name: Use nix cache
         uses: DeterminateSystems/magic-nix-cache-action@main
       - name: Download packaged crate
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: crate
           path: dist

.github/workflows/cron-directory-monitor.yml

@@ -6,6 +6,6 @@ jobs:
   health-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check /health endpoint
         run: cd payjoin-mailroom && bash contrib/health-check.sh

.github/workflows/cron-weekly-mutants.yml

@@ -9,12 +9,12 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-mutants@27.1.0
       - run: cargo mutants --in-place --no-shuffle
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: mutants.out

.github/workflows/csharp.yml

@@ -12,17 +12,36 @@ on:
       # the flake change this workflow's environment.
       - flake.nix
       - flake.lock
+  # GitHub Actions caches saved on a pull request branch are invisible to
+  # other pull requests; only caches saved on master are shared. Run the
+  # native asset builds on master so every pull request starts from a warm
+  # cross-compilation cache, and so cross-build breakage is caught after
+  # merge. The test, pack, and smoke jobs stay pull-request-only.
+  push:
+    branches: [master]
+    paths:
+      - payjoin-ffi/**
+
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build-csharp-and-test-unix:
     name: "Build and test csharp"
+    # Cache seeding on master pushes only needs build-nuget-native; see the
+    # push trigger comment above.
+    if: github.event_name != 'push'
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"
@@ -34,6 +53,9 @@ jobs:
 
   build-csharp-and-test-windows:
     name: "Build and test csharp (windows)"
+    # Cache seeding on master pushes only needs build-nuget-native; see the
+    # push trigger comment above.
+    if: github.event_name != 'push'
     runs-on: windows-latest
     env:
       RUSTUP_TOOLCHAIN: 1.85
@@ -42,15 +64,15 @@ jobs:
         working-directory: payjoin-ffi/csharp
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install Rust 1.85.0
         uses: dtolnay/rust-toolchain@1.85.0
 
       - name: Use cache
         uses: Swatinem/rust-cache@v2
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
@@ -102,7 +124,7 @@ jobs:
             target: x86_64-pc-windows-msvc
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust 1.85.0
         uses: dtolnay/rust-toolchain@1.85.0
@@ -111,6 +133,18 @@ jobs:
 
       - name: Use cache
         uses: Swatinem/rust-cache@v2
+        with:
+          # rust-cache derives its key from the job id, toolchain, and
+          # lockfiles, all identical across this matrix, so without an
+          # explicit key the six RIDs race for one cache entry and only
+          # the first finisher's target directory is ever stored.
+          key: ${{ matrix.rid }}
+          # cargo-xwin downloads the MSVC CRT/SDK here on every cold run.
+          cache-directories: ~/.cache/cargo-xwin
+          # Pull request branch caches are invisible to other pull requests
+          # and would duplicate the master entries within the repository's
+          # 10 GB cache budget; only the master seeding runs save.
+          save-if: ${{ github.event_name == 'push' }}
 
       - name: Install cross toolchain
         # Version- and hash-pinned: these tools produce the shipped binaries.
@@ -145,14 +179,17 @@ jobs:
           PAYJOIN_FFI_CROSS=1 PAYJOIN_FFI_RID=${{ matrix.rid }} bash ./scripts/build_nuget_native.sh
 
       - name: Upload NuGet native asset
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.rid }}
           path: payjoin-ffi/csharp/artifacts/runtimes/${{ matrix.rid }}/native/*
           if-no-files-found: error
 
   pack-nuget:
     name: "Pack C# NuGet package"
+    # Cache seeding on master pushes only needs build-nuget-native; see the
+    # push trigger comment above.
+    if: github.event_name != 'push'
     runs-on: ubuntu-latest
     needs: build-nuget-native
     env:
@@ -164,7 +201,7 @@ jobs:
         working-directory: payjoin-ffi/csharp
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust 1.85.0
         uses: dtolnay/rust-toolchain@1.85.0
@@ -173,12 +210,12 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Download native assets
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: payjoin-ffi/csharp/artifacts/downloaded
 
@@ -197,7 +234,7 @@ jobs:
         run: dotnet pack Payjoin.csproj --configuration Release --output artifacts/packages
 
       - name: Upload NuGet package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: payjoin-csharp-nuget-package
           path: payjoin-ffi/csharp/artifacts/packages/*.nupkg
@@ -227,15 +264,15 @@ jobs:
             rid: win-x64
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Download NuGet package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: payjoin-csharp-nuget-package
           path: payjoin-ffi/csharp/artifacts/packages

.github/workflows/dart.yml

@@ -13,6 +13,13 @@ on:
       - flake.nix
       - flake.lock
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-dart-and-test:
     name: "Build and test dart"
@@ -22,7 +29,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"

.github/workflows/flake-check.yml

@@ -1,11 +1,30 @@
 name: Flake Check
 
+# See rust.yml for why push events are restricted to master.
 on:
   push:
+    branches: [master]
   pull_request:
     types: [opened, synchronize, reopened]
-    paths-ignore:
+    # The msrv, stable, and nightly checks run the same workspace test
+    # suite that rust.yml already runs on every pull request, and the
+    # maintenance check duplicates the Lint and Format jobs. The signal
+    # unique to this workflow is that the nix packaging itself still
+    # works, so on pull requests it only runs when nix-relevant inputs
+    # change. Master pushes always run the full check.
+    paths:
+      - "**/*.nix"
       - "flake.lock"
+      - "Cargo-minimal.lock"
+      - "Cargo-recent.lock"
+      - "rust-toolchain.toml"
+
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   flake-check:
@@ -19,7 +38,7 @@ jobs:
           - maintenance
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main

.github/workflows/flake-maintenance.yml

@@ -16,7 +16,7 @@ jobs:
           - nightly
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -32,7 +32,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main

.github/workflows/format.yml

@@ -1,13 +1,24 @@
-name: Continuous integration
+name: Format
 
-on: [push, pull_request]
+# See rust.yml for why push events are restricted to master.
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   Format:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Install nix"
         uses: DeterminateSystems/determinate-nix-action@main
       - name: "Use nix cache"

.github/workflows/javascript.yml

@@ -13,6 +13,13 @@ on:
       - flake.nix
       - flake.lock
 
+# Pushing a new commit makes any still-running workflow for the same pull
+# request obsolete; cancel it instead of letting it occupy runners. Other
+# events get a unique group so they are never cancelled or queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-js-and-test:
     name: "Build and test javascript"
@@ -22,7 +29,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
       - name: "Install nix"