perf(ci): cache the fixture app build for the layer-3 differential

The differential job took ~30 minutes, of which 1331s (22 min, 79%) was building
the Expo fixture app and only 347s was the differential itself — rebuilt from
scratch on every run for an app that changes almost never.

Cache the built .app, keyed on everything that can change the binary: the app's
sources, native config, dependency graph, the build step itself, the iOS runtime,
and the Xcode version. Mirrors the existing setup-apple-replay prebuilt-runner
cache (same action pin, same Xcode-key + source-hash shape).

On a hit the build is skipped entirely and the bundle is installed straight onto
the booted simulator (~seconds), taking the job to roughly 8 minutes. On a miss
it falls back to exactly the previous behaviour and repopulates, so the worst
case is unchanged. The existing simctl verification still gates both paths, so a
bad cache cannot produce a vacuous green: if the app is not installed, the job
fails loudly rather than running scenarios against nothing.

Note the first run after this lands is necessarily a miss.

Author: thymikee

.github/workflows/conformance-differential.yml

@@ -78,17 +78,60 @@ jobs:
           runtime-version: ${{ env.IOS_RUNTIME_VERSION }}
           preferred-device-name: iPhone 17 Pro
 
+      # Building the fixture app costs ~22 minutes — 79% of this job — for an app
+      # that changes almost never, so cache the built .app and rebuild only when
+      # its sources or the toolchain change. Mirrors the setup-apple-replay
+      # prebuilt-runner cache. A miss simply falls back to the full build.
+      - name: Resolve Xcode cache key
+        id: xcode
+        run: |
+          set -euo pipefail
+          XCODE_KEY="$(xcodebuild -version | tr '\n' ' ' | sed -E 's/[[:space:]]+/ /g; s/[[:space:]]$//' | tr ' ' '-' | tr -cd '[:alnum:]._-')"
+          echo "key=$XCODE_KEY" >> "$GITHUB_OUTPUT"
+
+      - name: Cache fixture app build
+        id: fixture-app-cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.2.3
+        with:
+          path: ${{ github.workspace }}/.tmp/fixture-app
+          # Every input that can change the binary: app sources, native config,
+          # dependency graph, the build step itself, and the toolchain.
+          key: fixture-app-ios-${{ env.IOS_RUNTIME_VERSION }}-${{ steps.xcode.outputs.key }}-${{ hashFiles('examples/test-app/src/**', 'examples/test-app/app/**', 'examples/test-app/modules/**', 'examples/test-app/app.config.js', 'examples/test-app/package.json', 'examples/test-app/pnpm-lock.yaml', 'examples/test-app/pnpm-workspace.yaml', '.github/workflows/conformance-differential.yml') }}
+
       # The scenarios drive the real fixture app (com.callstack.agentdevicelab).
       # Release avoids needing a Metro server for the JS bundle; `expo run:ios`
       # prebuilds, builds, installs onto the booted simulator, and launches.
-      - name: Build and install the fixture app
+      - name: Build the fixture app
+        if: steps.fixture-app-cache.outputs.cache-hit != 'true'
         run: |
           set -euo pipefail
           pnpm test-app:install
           pnpm --dir examples/test-app exec expo run:ios \
             --configuration Release \
             --device "iPhone 17 Pro" \
             --no-bundler
+          # Stash the built bundle at a stable path so the cache has something
+          # deterministic to keep (DerivedData paths are hashed per project).
+          APP_PATH="$(find "$HOME/Library/Developer/Xcode/DerivedData" -type d -name '*.app' -path '*Release-iphonesimulator*' | head -1)"
+          if [ -z "$APP_PATH" ]; then
+            echo "::error::Built the fixture app but could not locate its .app bundle to cache."
+            exit 1
+          fi
+          mkdir -p "${{ github.workspace }}/.tmp/fixture-app"
+          cp -R "$APP_PATH" "${{ github.workspace }}/.tmp/fixture-app/"
+          echo "cached $(basename "$APP_PATH")"
+
+      # On a hit the app was never built this run, so install it explicitly. (On a
+      # miss `expo run:ios` already installed it; installing again is harmless.)
+      - name: Install the fixture app
+        run: |
+          set -euo pipefail
+          APP="$(find "${{ github.workspace }}/.tmp/fixture-app" -maxdepth 1 -type d -name '*.app' | head -1)"
+          if [ -z "$APP" ]; then
+            echo "::error::No fixture app bundle at .tmp/fixture-app (cache restored empty?)."
+            exit 1
+          fi
+          xcrun simctl install booted "$APP"
 
       - name: Verify the fixture app is installed
         run: |

scripts/maestro-conformance/README.md

@@ -148,6 +148,13 @@ The workflow builds and installs the fixture app, verifies its bundle id, pins
 the Maestro CLI to the same version as layers 1-2, and passes `--maestro` so the
 flow routes through the compat engine.
 
+The built `.app` is **cached** (keyed on the app's sources, its dependency graph,
+the iOS runtime, and the Xcode version), because building it costs ~22 minutes
+versus ~6 minutes for the differential itself — 79% of the job, for an app that
+changes almost never. A cache hit installs the bundle directly; a miss falls back
+to the full build and repopulates. If you change anything under
+`examples/test-app`, expect the next run to rebuild.
+
 **Investigate locally, not through CI.** A device iteration in CI is ~40 minutes;
 `--only` plus a local simulator is minutes: