From eea93a939725eb8c137fa52b285bd4ec25ea6218 Mon Sep 17 00:00:00 2001
From: Rhys Sullivan <39114868+RhysSullivan@users.noreply.github.com>
Date: Mon, 31 Aug 2026 00:56:48 -0700
Subject: [PATCH 1/3] desktop publish: blacksmith runners, bun/electron caches,
 dry-run input

---
 .github/workflows/publish-desktop.yml | 40 ++++++++++++++++++++++++---
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish-desktop.yml b/.github/workflows/publish-desktop.yml
index 166fcbf55..2db23715b 100644
--- a/.github/workflows/publish-desktop.yml
+++ b/.github/workflows/publish-desktop.yml
@@ -13,6 +13,11 @@ on:
         description: Git tag to publish (e.g. v1.4.1)
         required: true
         type: string
+      dry_run:
+        description: Build all distributables but do not touch the GitHub release
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -44,22 +49,22 @@ jobs:
           # smoke: run the compiled-sidecar smoke test on legs whose target
           # matches the runner (the mac x64 leg cross-compiles on an arm64
           # runner, so its binary can't be executed natively there).
-          - os: macos-latest
+          - os: blacksmith-6vcpu-macos-latest
             arch: arm64
             platform: mac
             bun-target: bun-darwin-arm64
             smoke: true
-          - os: macos-latest
+          - os: blacksmith-6vcpu-macos-latest
             arch: x64
             platform: mac
             bun-target: bun-darwin-x64
             smoke: false
-          - os: ubuntu-latest
+          - os: blacksmith-4vcpu-ubuntu-2404
             arch: x64
             platform: linux
             bun-target: bun-linux-x64
             smoke: true
-          - os: windows-latest
+          - os: blacksmith-8vcpu-windows-2025
             arch: x64
             platform: win
             bun-target: bun-windows-x64
@@ -103,6 +108,30 @@ jobs:
         with:
           node-version: 24
 
+      - name: Cache Bun package cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-cache-${{ runner.os }}-${{ runner.arch }}-
+
+      # Electron's postinstall downloads a ~120MB runtime zip into this cache,
+      # and electron-builder pulls its packaging tools (nsis, winCodeSign,
+      # AppImage) into a sibling cache on first use. Both are keyed only by
+      # version, so a lockfile-keyed cache stays warm across most releases.
+      - name: Cache Electron downloads
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/Library/Caches/electron
+            ~/Library/Caches/electron-builder
+            ~/.cache/electron
+            ~/.cache/electron-builder
+            ~/AppData/Local/electron/Cache
+            ~/AppData/Local/electron-builder/Cache
+          key: electron-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('bun.lock') }}
+          restore-keys: electron-cache-${{ runner.os }}-${{ runner.arch }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
@@ -215,6 +244,9 @@ jobs:
 
   release:
     needs: build
+    # dry_run builds and uploads workflow artifacts but never touches the
+    # GitHub release — used to rehearse workflow changes against a real tag.
+    if: ${{ !inputs.dry_run }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write

From 5f39eec8bb5e7ee6425cfe12ef2fcf2fc228a209 Mon Sep 17 00:00:00 2001
From: Rhys Sullivan <39114868+RhysSullivan@users.noreply.github.com>
Date: Mon, 31 Aug 2026 01:05:06 -0700
Subject: [PATCH 2/3] desktop publish: parallelize release asset uploads

---
 .github/workflows/publish-desktop.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish-desktop.yml b/.github/workflows/publish-desktop.yml
index 2db23715b..60771635f 100644
--- a/.github/workflows/publish-desktop.yml
+++ b/.github/workflows/publish-desktop.yml
@@ -287,14 +287,15 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          while IFS= read -r file; do
-            echo "Uploading: $file"
-            gh release upload "$RELEASE_TAG" "$file" --repo "$GITHUB_REPOSITORY" --clobber
-          done < <(find artifacts -type f \
+          # Parallel uploads; xargs exits non-zero if any single upload fails,
+          # which keeps the promote step below from running on a partial set.
+          find artifacts -type f \
             \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" \
             -o -name "*.AppImage" -o -name "*.deb" -o -name "*.rpm" \
             -o -name "*.blockmap" \
-            -o -name "latest*.yml" \))
+            -o -name "latest*.yml" \) -print0 \
+            | xargs -0 -n1 -P8 -I{} sh -c \
+              'echo "Uploading: $1"; exec gh release upload "$RELEASE_TAG" "$1" --repo "$GITHUB_REPOSITORY" --clobber' _ {}
 
       # Flip draft → published only after every desktop asset is uploaded —
       # this is the atomic point where the new tag becomes "latest".

From 8ef413f9004efa74b341f88faa0696641a244cc2 Mon Sep 17 00:00:00 2001
From: Rhys Sullivan <39114868+RhysSullivan@users.noreply.github.com>
Date: Mon, 31 Aug 2026 01:12:20 -0700
Subject: [PATCH 3/3] desktop publish: drop caches, cold install is faster on
 these runners

---
 .github/workflows/publish-desktop.yml | 29 +++++----------------------
 1 file changed, 5 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/publish-desktop.yml b/.github/workflows/publish-desktop.yml
index 60771635f..f4bb1bb5b 100644
--- a/.github/workflows/publish-desktop.yml
+++ b/.github/workflows/publish-desktop.yml
@@ -108,30 +108,11 @@ jobs:
         with:
           node-version: 24
 
-      - name: Cache Bun package cache
-        uses: actions/cache@v4
-        with:
-          path: ~/.bun/install/cache
-          key: bun-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('bun.lock') }}
-          restore-keys: bun-cache-${{ runner.os }}-${{ runner.arch }}-
-
-      # Electron's postinstall downloads a ~120MB runtime zip into this cache,
-      # and electron-builder pulls its packaging tools (nsis, winCodeSign,
-      # AppImage) into a sibling cache on first use. Both are keyed only by
-      # version, so a lockfile-keyed cache stays warm across most releases.
-      - name: Cache Electron downloads
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/Library/Caches/electron
-            ~/Library/Caches/electron-builder
-            ~/.cache/electron
-            ~/.cache/electron-builder
-            ~/AppData/Local/electron/Cache
-            ~/AppData/Local/electron-builder/Cache
-          key: electron-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('bun.lock') }}
-          restore-keys: electron-cache-${{ runner.os }}-${{ runner.arch }}-
-
+      # No package/electron caches here on purpose: on Blacksmith's NVMe
+      # runners a cold `bun install` (8-55s) is as fast as a cache
+      # restore + warm install, and bun.lock changes on every release
+      # (Version Packages), so each publish would pay the cache-save tail
+      # (~45s on the mac critical path) for nothing.
       - name: Install dependencies
         run: bun install --frozen-lockfile