perf: optimize CI/CD pipeline with caching and parallel builds (#42)

* perf: optimize CI/CD pipeline with caching and parallel builds

- Add Bun dependency caching to CI and Release workflows
- Add pip caching to Python test, docs, and engine publish workflows
- Separate lint into its own fast job (dev-only deps, no warehouses)
- Split release binary builds into 3 parallel matrix jobs (linux/darwin/win32)
- Add --targets flag to build.ts for OS-based target filtering
- Remove unnecessary publish-npm dependency from GitHub Release job
- Add concurrency control to release workflow

Expected improvements:
- Release: ~18min → ~8-9min (parallel builds + parallel publishing)
- CI: faster repeat runs via dependency caching

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: address PR review feedback

- Restore github-release dependency on publish-npm to prevent partial
  releases where npm install instructions point to unpublished packages
- Use `pip install ruff` in lint job instead of `.[dev]` for faster runs
- Create docs/requirements.txt for proper pip cache invalidation
- Add cache-dependency-path to publish-engine and release publish-engine
- Validate --targets flag against known OS values (linux/darwin/win32)
- Add comment documenting intentional publish-engine parallelism
- Simplify concurrency group name

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: anandgupta42

.github/workflows/ci.yml

@@ -15,6 +15,14 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
 
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
       - name: Configure git for tests
         run: |
           git config --global user.name "CI"
@@ -27,6 +35,23 @@ jobs:
         run: bun test
         working-directory: packages/altimate-code
 
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install linter
+        run: pip install ruff
+
+      - name: Lint
+        run: ruff check src
+        working-directory: packages/altimate-engine
+
   python:
     name: Python ${{ matrix.python-version }}
     runs-on: ubuntu-latest
@@ -39,6 +64,8 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+          cache-dependency-path: packages/altimate-engine/pyproject.toml
 
       - name: Install dependencies
         run: pip install -e ".[dev,warehouses]"
@@ -47,7 +74,3 @@ jobs:
       - name: Run tests
         run: pytest
         working-directory: packages/altimate-engine
-
-      - name: Lint
-        run: ruff check src
-        working-directory: packages/altimate-engine

.github/workflows/docs.yml

@@ -26,6 +26,8 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+          cache: "pip"
+          cache-dependency-path: docs/requirements.txt
 
       - name: Install mkdocs-material
         run: pip install mkdocs-material

.github/workflows/publish-engine.yml

@@ -18,6 +18,8 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+          cache: "pip"
+          cache-dependency-path: packages/altimate-engine/pyproject.toml
 
       - name: Install build tools
         run: pip install build

.github/workflows/release.yml

@@ -5,6 +5,10 @@ on:
     tags:
       - "v*"
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 permissions:
   contents: write
   id-token: write
@@ -14,18 +18,30 @@ env:
 
 jobs:
   build:
-    name: Build
+    name: Build (${{ matrix.os }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [linux, darwin, win32]
     steps:
       - uses: actions/checkout@v4
 
       - uses: oven-sh/setup-bun@v2
 
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install
 
-      - name: Build all targets
-        run: bun run packages/altimate-code/script/build.ts
+      - name: Build ${{ matrix.os }} targets
+        run: bun run packages/altimate-code/script/build.ts --targets=${{ matrix.os }}
         env:
           ALTIMATE_CLI_VERSION: ${{ github.ref_name }}
           ALTIMATE_CLI_CHANNEL: latest
@@ -36,7 +52,7 @@ jobs:
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: dist
+          name: dist-${{ matrix.os }}
           path: packages/altimate-code/dist/
 
   publish-npm:
@@ -48,14 +64,23 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
 
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install
 
-      - name: Download build artifacts
+      - name: Download all build artifacts
         uses: actions/download-artifact@v4
         with:
-          name: dist
+          pattern: dist-*
           path: packages/altimate-code/dist/
+          merge-multiple: true
 
       - name: Configure npm auth
         run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
@@ -89,9 +114,10 @@ jobs:
           GH_REPO: ${{ env.GH_REPO }}
           GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
 
+  # Engine publish runs without waiting for build — it builds from source and
+  # doesn't need CLI binary artifacts. This allows it to run in parallel.
   publish-engine:
     name: Publish engine to PyPI
-    needs: build
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
@@ -103,6 +129,8 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+          cache: 'pip'
+          cache-dependency-path: packages/altimate-engine/pyproject.toml
 
       - name: Install build tools
         run: pip install build
@@ -177,11 +205,12 @@ jobs:
           GH_REPO: ${{ env.GH_REPO }}
           CURRENT_TAG: ${{ github.ref_name }}
 
-      - name: Download build artifacts
+      - name: Download all build artifacts
         uses: actions/download-artifact@v4
         with:
-          name: dist
+          pattern: dist-*
           path: packages/altimate-code/dist/
+          merge-multiple: true
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2

docs/requirements.txt

@@ -0,0 +1 @@
+mkdocs-material

packages/altimate-code/script/build.ts

@@ -129,6 +129,17 @@ const allTargets: {
   },
 ]
 
+// If --targets is provided, filter to only matching OS values
+const validOsValues = new Set(allTargets.map(t => t.os))
+const targetsFlag = process.argv.find(a => a.startsWith('--targets='))?.split('=')[1]?.split(',')
+if (targetsFlag) {
+  const invalid = targetsFlag.filter(t => !validOsValues.has(t))
+  if (invalid.length > 0) {
+    console.error(`error: invalid --targets value(s): ${invalid.join(', ')}. Valid values: ${[...validOsValues].join(', ')}`)
+    process.exit(1)
+  }
+}
+
 const targets = singleFlag
   ? allTargets.filter((item) => {
       if (item.os !== process.platform || item.arch !== process.arch) {
@@ -148,7 +159,9 @@ const targets = singleFlag
 
       return true
     })
-  : allTargets
+  : targetsFlag
+    ? allTargets.filter(t => targetsFlag.includes(t.os))
+    : allTargets
 
 await $`rm -rf dist`