perf(release): start Windows builds without waiting for the Linux job

.github/workflows/desktop-macos-preview-publish.yml

@@ -284,6 +284,10 @@ jobs:
     concurrency:
       group: desktop-macos-preview-${{ needs.resolve.outputs.pr_number }}-build
       cancel-in-progress: true
+    # release-desktop.yml asks for actions: read (its Windows builds list artifacts).
+    permissions:
+      actions: read
+      contents: read
     uses: ./.github/workflows/release-desktop.yml
     secrets:
       CSC_LINK: ${{ secrets.CSC_LINK }}

.github/workflows/release-desktop.yml

@@ -93,13 +93,17 @@ on:
         type: string
 
 permissions:
+  # Windows builds read this run's artifact list to wait for the Linux CLI archive.
+  actions: read
   contents: read
 
 jobs:
   build:
     name: Build ${{ inputs.label }}
     runs-on: ${{ inputs.runner }}
-    timeout-minutes: 30
+    # Windows waits for the Linux CLI archive inside its own budget (see
+    # "Wait for Linux CLI archive"), so it gets that wait on top of the usual 30.
+    timeout-minutes: ${{ inputs.platform == 'win' && 70 || 30 }}
     env:
       T3CODE_CLERK_PUBLISHABLE_KEY: ${{ inputs.clerk_publishable_key }}
       T3CODE_CLERK_JWT_TEMPLATE: ${{ inputs.clerk_jwt_template }}
@@ -204,15 +208,6 @@ jobs:
           name: js-bundle
           path: apps
 
-      # The WSL backend runs the Linux CLI archive inside the distro, so the
-      # Windows desktop embeds the same-arch archive the release attaches.
-      - name: Download Linux CLI archive for WSL
-        if: inputs.platform == 'win'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: cli-linux-${{ inputs.arch }}
-          path: wsl-runtime
-
       # Only the resource monitor build needs these libraries. With a cached
       # monitor, the desktop build's preflight skips its MSVC check, and node-pty
       # ships prebuilt Windows binaries, so the 30-60s install is skipped too.
@@ -314,6 +309,57 @@ jobs:
             Select-Object -Unique
           "PSModulePath=$($modulePathEntries -join ';')" >> $env:GITHUB_ENV
 
+      # The WSL backend runs the Linux CLI archive inside the distro, so the
+      # Windows desktop embeds the same-arch archive the release attaches.
+      # This job starts alongside that Linux job instead of after it, and the
+      # Linux job uploads the archive partway through, so the wait is placed
+      # after all other setup. It stops early if the Linux job ended without
+      # uploading the archive.
+      - name: Wait for Linux CLI archive
+        if: inputs.platform == 'win'
+        shell: pwsh
+        timeout-minutes: 40
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          ARTIFACT: cli-linux-${{ inputs.arch }}
+          LINUX_JOB: Build Linux ${{ inputs.arch }}
+        run: |
+          $headers = @{ Authorization = "Bearer $env:GITHUB_TOKEN"; Accept = "application/vnd.github+json" }
+          $run = "$env:GITHUB_API_URL/repos/$env:GITHUB_REPOSITORY/actions/runs/$env:GITHUB_RUN_ID"
+          function Test-Archive {
+            (Invoke-RestMethod -Headers $headers -Uri "$run/artifacts?name=$env:ARTIFACT").total_count -gt 0
+          }
+          while ($true) {
+            try {
+              if (Test-Archive) {
+                Write-Host "$env:ARTIFACT is ready."
+                exit 0
+              }
+              $jobs = Invoke-RestMethod -Headers $headers -Uri "$run/attempts/$env:GITHUB_RUN_ATTEMPT/jobs?per_page=100"
+              $linux = $jobs.jobs | Where-Object { $_.name.EndsWith($env:LINUX_JOB) } | Select-Object -First 1
+              if ($linux.conclusion) {
+                # The upload may have landed between the two requests above.
+                if (Test-Archive) {
+                  Write-Host "$env:ARTIFACT is ready."
+                  exit 0
+                }
+                Write-Host "::error::$env:LINUX_JOB ended ($($linux.conclusion)) without uploading $env:ARTIFACT."
+                exit 1
+              }
+            } catch {
+              Write-Warning "Could not read this run's artifacts or jobs: $($_.Exception.Message)"
+            }
+            Write-Host "Waiting for $env:ARTIFACT..."
+            Start-Sleep -Seconds 10
+          }
+
+      - name: Download Linux CLI archive for WSL
+        if: inputs.platform == 'win'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: cli-linux-${{ inputs.arch }}
+          path: wsl-runtime
+
       - name: Build desktop artifact
         shell: bash
         env:

.github/workflows/release.yml

@@ -37,6 +37,9 @@ concurrency:
   queue: max
 
 permissions:
+  # The Windows desktop jobs read this run's artifact list to wait for the
+  # Linux CLI archive they embed (see release-desktop.yml).
+  actions: read
   contents: read
   id-token: none
 
@@ -531,11 +534,12 @@ jobs:
           retention-days: 1
 
   # One job per platform and architecture (see release-desktop.yml), each on
-  # hardware of its own architecture, and each gated only on what it consumes:
-  # every platform needs the JS bundle, and the Windows jobs also need the
-  # same-arch Linux job, whose CLI archive they embed as the WSL runtime. Every
-  # job builds the desktop app; all but macOS x64 also build the CLI archive
-  # for their platform, so a target either ships fully or not at all.
+  # hardware of its own architecture, and each gated only on the JS bundle.
+  # The Windows jobs also embed the same-arch Linux CLI archive as the WSL
+  # runtime; they wait for that artifact partway through instead of for the
+  # whole Linux job. Every job builds the desktop app; all but macOS x64 also
+  # build the CLI archive for their platform, so a target either ships fully or
+  # not at all.
   desktop_mac_arm64:
     name: Desktop macOS arm64
     needs: [preflight, relay_public_config, build_bundle]
@@ -633,13 +637,12 @@ jobs:
       resource_key: linux-arm64
       cli_archive: true
 
-  # The Windows jobs embed the same-arch Linux CLI archive as the WSL runtime.
-  # `!cancelled()` (not `!failure()`) still lets them start when that Linux job
-  # failed; the download step inside then fails this single platform if the
-  # archive is missing.
+  # The Windows jobs start with the other platforms. Their checkout, install,
+  # and toolchain setup take longer than the same-arch Linux job needs to
+  # upload its CLI archive, so the wait inside is usually instant.
   desktop_win_x64:
     name: Desktop Windows x64
-    needs: [preflight, relay_public_config, build_bundle, desktop_linux_x64]
+    needs: [preflight, relay_public_config, build_bundle]
     if: ${{ !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.result == 'success' && needs.build_bundle.result == 'success' }}
     uses: ./.github/workflows/release-desktop.yml
     secrets: inherit
@@ -662,7 +665,7 @@ jobs:
 
   desktop_win_arm64:
     name: Desktop Windows arm64
-    needs: [preflight, relay_public_config, build_bundle, desktop_linux_arm64]
+    needs: [preflight, relay_public_config, build_bundle]
     if: ${{ !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.result == 'success' && needs.build_bundle.result == 'success' }}
     uses: ./.github/workflows/release-desktop.yml
     secrets: inherit

docs/operations/release.md

@@ -26,7 +26,7 @@ This document covers the unified release workflow for stable and nightly desktop
 - Runs lint, typecheck, and tests alongside artifact builds. Publishing waits for every check.
 - Reads the shared production T3 Connect relay URL and Clerk client configuration before packaging clients.
 - Builds the platform-independent JS (server bundle, web client, Electron main) once in the `build_bundle` job and hands it to every platform job as the `js-bundle` artifact; the platform jobs only package it, so no runner rebuilds it.
-- Builds six desktop artifacts in parallel for both channels, each as its own job (`desktop_<platform>_<arch>`, one call of `release-desktop.yml`) on hardware of its own architecture, gated only on the bundle (the Windows jobs also wait for the same-arch Linux job, whose CLI archive they embed as the WSL runtime):
+- Builds six desktop artifacts in parallel for both channels, each as its own job (`desktop_<platform>_<arch>`, one call of `release-desktop.yml`) on hardware of its own architecture, gated only on the bundle. The Windows jobs embed the same-arch Linux CLI archive as the WSL runtime and wait for that artifact partway through, not for the whole Linux job:
   - macOS `arm64` DMG
   - macOS `x64` DMG
   - Linux `x64` and `arm64` AppImage and `.deb`, from one electron-builder run. The `.deb` updates in the app through electron-updater, which installs it with `dpkg`.