Scale the CI timeout with replica count; record the build-once decision

A roll installs and builds on every replica in turn, inside one job. The
generated workflow hard-coded 30 minutes, which is comfortable for one
server and tight for four — and a timeout mid-roll is the worst place to
stop, leaving the fleet on mixed versions with a replica drained.

ADR-0007 now records build-once as considered and declined rather than
merely absent. With a committed lockfile the per-replica builds are
equivalent, so it is a wall-clock cost rather than a correctness gate,
and both implementations cost more than they save: building on the
primary and copying needs SSH between servers, a new trust edge in a tool
whose premise is that it needs nothing but your SSH access to each box;
building locally fails silently for native modules when the developer's
platform differs from the servers'.

Author: devalade

README.md

@@ -252,6 +252,8 @@ export default shipnode
 
 Replicas serve plain HTTP on the private network and never claim the domain — five replicas all requesting a certificate for the same name would race Let's Encrypt. **TLS terminates at your load balancer.**
 
+Each replica installs and builds, so a three-replica roll takes roughly three times a single deploy. `shipnode ci github` sizes the workflow timeout accordingly.
+
 | Setting | Default | Description |
 |---|---|---|
 | `.group(name, servers)` | — | Name a set of servers so `on` can target them all at once |

docs/adr/0007-fleet-replication.md

@@ -84,4 +84,10 @@ Accessories stay single-node. Shipnode replicating Postgres is out of scope, and
 - **A shipnode-managed load balancer** — a Cloudflare tunnel with N connectors, or an edge Caddy node. The drain contract is designed so either could be added later as an alternative drain implementation without disturbing the roller.
 - **Pass-through TLS.** Replicas serve plain HTTP; the LB terminates.
 - **Replicated accessories.** One Postgres, on one server.
-- **Building once and shipping the artifact.** Each replica still builds. With a committed lockfile the builds are equivalent, so this is a time optimisation rather than a correctness gate, and the two ways to implement it — building locally, or copying between servers — each impose an infrastructure requirement that has not been chosen.
+- **Building once and shipping the artifact.** Each replica installs and builds, so an N-replica roll costs N builds. This was considered and declined.
+
+  The case for it is that a floating dependency could resolve differently on each replica and produce N different artifacts. With a committed lockfile — the normal case — it cannot, so this is a wall-clock cost rather than a correctness gate. Frontends are already unaffected: `FrontendStrategy` builds locally and rsyncs only `buildDir`.
+
+  Both implementations impose an infrastructure requirement that outweighs the saving. Building on the primary and copying to its peers needs SSH *between servers*, a new trust edge in a tool whose whole premise is that it needs nothing but your SSH access to each box. Building locally needs the developer's machine or CI runner to produce server-compatible binaries, which fails silently for native modules — `sharp`, `esbuild`, `better-sqlite3`, Prisma engines — when someone deploys from macOS arm64 to linux x64.
+
+  Revisit if fleets get large enough that build time dominates, or if shipnode grows a container image path where the artifact is already portable by construction.

src/cli/commands/ci.ts

@@ -177,6 +177,11 @@ function generateWorkflow(
     : '';
   const commandOptions = renderCommandOptions(options);
 
+  // A roll installs and builds on every replica in turn, inside one job. Thirty
+  // minutes is comfortable for one server and tight for four, and a timeout
+  // mid-roll leaves the fleet on mixed versions with a replica drained.
+  const deployTimeoutMinutes = 30 * Math.max(1, hosts.length);
+
   const knownHostsScan = hosts.length > 0 ? hosts.join(' ') : '<your-server>';
   // Fail before the roll rather than during it. A host missing from
   // known_hosts otherwise surfaces as an SSH failure on replica three, with
@@ -238,7 +243,7 @@ concurrency:
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: ${deployTimeoutMinutes}
     environment: ${yamlSingleQuoted(environment)}
 
     steps:

tests/unit/ci-github.test.ts

@@ -200,6 +200,9 @@ describe('ci github', () => {
     expect(workflow).toContain('Verify every replica is a known host');
     expect(workflow).toContain("for host in '10.0.0.11' '10.0.0.12'");
     expect(workflow).toContain('ssh-keyscan 10.0.0.11 10.0.0.12');
+    // Each replica installs and builds in turn inside one job; a timeout
+    // mid-roll leaves the fleet on mixed versions with a replica drained.
+    expect(workflow).toContain('timeout-minutes: 60');
   });
 
   it('omits the replica check for a single-server workspace', async () => {
@@ -216,6 +219,8 @@ describe('ci github', () => {
 
     await cmdCiGithub(root, { app: 'api', syncEnv: true });
 
-    expect(await readWorkflow(root)).not.toContain('Verify every replica is a known host');
+    const workflow = await readWorkflow(root);
+    expect(workflow).not.toContain('Verify every replica is a known host');
+    expect(workflow).toContain('timeout-minutes: 30');
   });
 });