ci(test): move CI to ARM64 runners and scope nextest retries

Switch both CI jobs to the free ubuntu-24.04-arm runners and link test
binaries with mold to cut the --all-features cold-cache link time.
Also stop applying the cluster tests' high retry count profile-wide;
give it back to them via a dedicated ci-profile override so ordinary
single-node tests aren't penalized by a retry budget meant for
cluster bring-up jitter.

Author: farhan-syah

.config/nextest.toml

@@ -110,20 +110,26 @@ server-process-serial = { max-threads = 1 }
 
 [profile.ci]
 # CI inherits the default profile (cluster group, threads-required,
-# slow-timeout) and adds:
-#   - more retries: CI runners are ~2× slower per-core than dev
-#     workstations, so the cluster tests' in-test `wait_for`
-#     budgets are proportionally tighter. Three retries (four total
-#     attempts) buys headroom for jitter without papering over real
-#     regressions — a genuinely broken test fails four times in a row.
-#   - JUnit XML: picked up by the workflow's artifact upload.
+# slow-timeout) and adds retries + JUnit XML.
+#
+# Retries are scoped, not blanket. The bulk of the suite (unit tests +
+# single-node server tests) is deterministic; the ONE non-cluster flake
+# source is the rare ephemeral-port reuse race in the `server-process`
+# group, which a single retry covers. So the profile-wide retry is just
+# `count = 1` (two attempts). A blanket high count here is worse than
+# useless: nextest resolves retries per-test with overrides winning over
+# the profile-wide value, so a high number here never even reached the
+# cluster tests (their `default` override pins count = 2) — it only
+# multiplied the timeout tail of every slow single-node server test by
+# 4×. The cluster tests get their genuine CI headroom from the dedicated
+# override below instead.
 #
 # NOTE: we deliberately do NOT bump `slow-timeout` here. The
 # slow-timeout only controls when nextest gives up on a stuck
 # *process*; it does NOT extend the test's internal `wait_for`
 # budgets. Once a `wait_for` panics, the test has already failed —
 # making nextest wait longer just wastes CI minutes on cleanup.
-retries = { backoff = "fixed", count = 3, delay = "2s" }
+retries = { backoff = "fixed", count = 1, delay = "2s" }
 fail-fast = false
 
 # Four cluster tests are excluded from the CI profile ONLY. They still run under
@@ -157,5 +163,16 @@ not (
 )
 """
 
+# CI-only cluster headroom. On CI runners (~2× slower per-core than a dev
+# workstation) the cluster tests' in-test `wait_for` budgets are proportionally
+# tighter, so 3-node bring-up jitter needs more retry headroom than the
+# `default` profile's count = 2. Four attempts absorbs startup jitter without
+# hiding regressions — a genuinely broken test fails four times in a row. This
+# `ci`-profile override is checked before the `default`-profile cluster override
+# and so wins under `--profile ci`; local `cargo nextest run` still gets count = 2.
+[[profile.ci.overrides]]
+filter = 'package(nodedb-cluster-tests)'
+retries = { backoff = "fixed", count = 3, delay = "2s" }
+
 [profile.ci.junit]
 path = "junit.xml"

.github/workflows/test.yml

@@ -22,11 +22,21 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  # Link the workspace's test binaries with mold instead of the default BFD
+  # linker. With --all-features every test binary statically links the full
+  # dependency closure and there are hundreds of them, so linking — not
+  # codegen — dominates the cold-cache build. mold cuts that link time several-
+  # fold. Applies to both jobs; installed via apt below.
+  RUSTFLAGS: "-C link-arg=-fuse-ld=mold"
 
 jobs:
   lint:
     name: Lint & Check
-    runs-on: ubuntu-latest
+    # Free ARM64 runner for public repos: ~40% faster per-core than
+    # ubuntu-latest at the same (zero) cost. The release workflows already
+    # build on ubuntu-24.04-arm, so the toolchain + system deps are proven
+    # on this ISA.
+    runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v7
       - name: Install Rust
@@ -41,7 +51,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             cmake clang libclang-dev pkg-config protobuf-compiler perl \
-            libcurl4-openssl-dev libsasl2-dev
+            libcurl4-openssl-dev libsasl2-dev mold
       - name: Check formatting
         run: cargo fmt --all -- --check
       - name: Run clippy
@@ -72,7 +82,8 @@ jobs:
   # serialised by `.config/nextest.toml`'s `cluster` test group.
   test:
     name: Test
-    runs-on: ubuntu-latest
+    # Free ARM64 runner — see the lint job for rationale.
+    runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v7
       - name: Reclaim disk and record resources
@@ -109,7 +120,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             cmake clang libclang-dev pkg-config protobuf-compiler perl \
-            libcurl4-openssl-dev libsasl2-dev
+            libcurl4-openssl-dev libsasl2-dev mold
       - name: Install cargo-nextest
         uses: taiki-e/install-action@v2
         with: