perf(release): build Windows alongside Mac and preserve signing quota

[nwparker]

ELI5

Adhoc Windows builds currently start after macOS finishes. Build their unsigned installer alongside Mac notarization, then upload only after Mac succeeds. Production Windows signing also waits for successful macOS completion, so a failed Mac build consumes no SignPath quota.

What Changed

• Compute the adhoc version once before desktop builds, so both platforms package the same commit and version concurrently.
• Add an optional staging mode to the existing Windows workflow and a small publisher that downloads the same run's installer, blockmap, and manifest. Existing hourly, daily, and standalone Windows behavior stays the default.
• Before either production SignPath request, verify the exact Mac run, workflow commit, attempt, and original deadline. Unsigned compilation and packaging still run concurrently. Restore the current verifier when building an older source ref, and fix its Windows file-path entry check.
• Add a timing report based on completed workflow job and step timestamps, including measured overlap and artifact-transfer overhead.

Why

A same-source hosted comparison reduced the desktop phase from 18m18s to 10m18s: 8m00s faster (43.7%), including final publication. Mac and Windows overlapped for 6m49s. Moving upload into a separate gated job removes the build dependency while retaining the Mac-success boundary. This reuses the existing Windows packager and Mac verifier rather than duplicating the signing flow.

Linked Issue

N/A — maintainer-requested release performance work.

Visual Proof

N/A — workflow scheduling and signing gates only; no application UI change.

Testing

• Focused workflow, version, signing-gate, runtime-contract, cache-policy, reference-validation, and timing tests passed locally.
• Formatting, targeted lint, changed-code quality, and diff checks passed.
• Actionlint passed for the changed workflows with the existing custom runner label allowed and existing unrelated shellcheck diagnostics excluded.
• Independent review found no blocking findings and independently passed 63 focused tests.
• Real same-source adhoc control and candidate builds passed; all 12 assets are live. Downloaded the candidate Windows installer and verified its SHA-512 and size against latest.yml, checked the blockmap, and matched Mac/Windows versions. Both platforms verified all nine SSH template targets; both Mac architectures passed notarization.
• Full PR Checks workflow and its PR checks passed aggregate succeeded for 3651503ced5f3a5e86dfc8fcf47ed3e61593f411; pnpm tc passed locally.

Review

Checked failure/cancellation/skipped-template handling, old source refs, reruns, matching version and SHA, same-run artifact transfer, credentials withheld during staging, both SignPath requests, and existing publication gates.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer material copied.

Notes

Production already overlaps Windows preparation with the external Mac run; its change enforces quota protection rather than claiming a new production build speedup. Adhoc Windows remains unsigned; these experiments used no SignPath quota.

Measurement	Sequential control	Parallel candidate
Desktop through final publication	18m18s	10m18s
Mac job	9m56s	9m35s
Windows job time, including publisher	8m17s	7m27s
Mac/Windows overlap	0	6m49s

• Control run: main workflow at db6b3fd, building source 3651503.
• Candidate run: PR workflow and source at 3651503.
• Intervals start at each job's first actual step and include setup, teardown, scheduling between desktop jobs, and publication. The candidate spent 9s transferring staged artifacts; its entire publisher job took 21s, starting at 07:04:52 UTC after Mac completed at 07:04:47 UTC.
• Candidate qualification initially failed in Windows ARM daemon-descendant teardown (wsl.exe/conhost.exe) and passed an unchanged failed-job retry. Its whole elapsed time was consequently longer (41m04s versus 34m56s); no whole-run speedup is claimed. The measured desktop phase starts after qualification. Runner/cache/notary variation also affects this two-run sample; the 6m49s of observed overlap directly verifies the scheduling change. Of the observed 8m00s reduction, 6m49s comes from overlap and 1m11s from shorter individual job runtimes; the full reduction cannot be attributed solely to concurrency.
• Reproduce the report with gh run view RUN_ID --json url,headSha,createdAt,updatedAt,status,conclusion,jobs, then node config/scripts/release-desktop-timing.mjs control.json candidate.json report.json. Header headSha identifies the workflow version; resolve-ref and checkout logs verify the same built source separately.

Checklist

• Focused on Windows build scheduling and Mac-success signing/publication gates
• Explained user-visible behavior, mechanism, and approach
• Visual proof is not applicable
• Self-reviewed and independently reviewed for correctness, security, and performance
• Cross-platform and SSH server-template requirements preserved
• Required hosted checks and affected workflow validation complete

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6e7b729c-0d46-472d-85fa-8a0b75b7aa9c

📥 Commits

Reviewing files that changed from the base of the PR and between db6b3fd and 3651503.

📒 Files selected for processing: 11

• .github/workflows/adhoc-mac-build.yml
• .github/workflows/dev-channel-win-build.yml
• .github/workflows/dev-channel-win-publish.yml
• .github/workflows/release-cut.yml
• config/scripts/adhoc-windows-parallelism.test.mjs
• config/scripts/dev-channel-windows-staging.test.mjs
• config/scripts/release-desktop-timing.mjs
• config/scripts/release-desktop-timing.test.mjs
• config/scripts/release-windows-signing-gate.test.mjs
• config/scripts/run-release-mac-build-workflow.mjs
• config/scripts/workflow-ref-mirror-case-safety.test.mjs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

📝 Walkthrough

The adhoc workflow now shares build identity outputs and stages Windows artifacts for gated publication. Reusable workflows support Windows artifact staging and publication. The release workflow gates Windows signing on the exact macOS build run. New utilities summarize and compare desktop release timing.

Priority: ➖ Normal

Merge Risk: 🔵 Low · up to 36515

A slow release may need a fresh dispatch if the Windows job times out during signing approval. This is a bounded release risk to address or explicitly accept before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 7 files. (4 skipped: 4…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly summarizes the primary change: parallel Windows and macOS release preparation while preserving the macOS gate for signing quota protection.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The pull request description is complete and matches the repository template. It explains the change, rationale, testing, visual-proof status, review scope, compatibility considerations, and checklist…

Full details: Description check

Explanation

The pull request description is complete and matches the repository template. It explains the change, rationale, testing, visual-proof status, review scope, compatibility considerations, and checklist items. The linked issue is marked N/A with a maintainer exception, which the template allows. The description does not list every required command individually, but it reports successful hosted checks and related validation.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 7 files. (4 skipped: 4 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}