ci-efficiency

# CI Efficiency Audit Inspect the repository's GitHub Actions workflows, identify waste sources, and recommend targeted fixes to reduce CI minutes and cost. ## This Codebase's CI Structure The CI entry point is MISE (`mise run`). All builds and tests go through it: ```bash mise run [--variant fips|non-fips] [--link static|dynamic] <task> ``` Key workflows: - `.github/workflows/main.yml` — push and pull-request CI - `.github/workflows/test_all.yml` — full test matrix - `.github/workflows/release.yml` — release automation - `.github/workflows/packaging.yml`, `packaging-docker.yml`, `packaging-tests.yml` — packaging Test matrix variants: `sqlite`, `psql`, `mariadb`, `percona`, `wasm`, `google_cse`, `gcp_cmek`, `otel_export`, `hsm`, `redis` (non-fips), `aws_xks` (non-fips), `azure_ekm` (non-fips), `ui` (non-fips). ## Step 1 — Measure First ```bash # Scan for efficiency signals rg -n "on:|concurrency:|paths:|paths-ignore:|strategy:|matrix:|cache:" .github/workflows # Check recent run history (if gh CLI available) GH_PAGER=cat gh run list --limit 10 --repo Cosmian/kms run_id=$(GH_PAGER=cat gh run list --limit 1 --json databaseId --jq '.[0].databaseId' --repo Cosmian/kms) GH_PAGER=cat gh run view "$run_id" --log-failed --repo Cosmian/kms ``` Look for: - Missing dependency caches (Rust `~/.cargo`, `target/`, nix store, pnpm store) - Missing `concurrency` groups to cancel stale runs on the same PR - Over-broad triggers (full matrix on every push to any branch) - Duplicate workflow coverage (same job in both `main.yml` and `test_all.yml`) - Expensive jobs running regardless of what changed (e.g. UI E2E triggered by Rust-only changes) - Jobs that are unused and matrix entries that duplicate existing coverage ## Step 2 — Apply Guardrails Before recommending any fix, verify it passes all guardrails: 1. Does not hide required validation — do not remove FIPS/non-FIPS test matrix legs that have explicit version commitments. 2. Does not reduce parallelism without justification. 3. Preserves security-critical checks — secret scanning, Dependabot, SBOM generation must not be gated behind path filters. 4. Write-back jobs (auto-formatting, CLI doc regeneration) must use opt-in triggers, not run on every PR. 5. Nix hash update jobs must not be silently skipped. ## Step 3 — Select Top 3 Fixes From these candidates, keep only those supported by audit evidence AND passing all guardrails. Rank by estimated daily CI minutes saved: 1. **Dependency caching** — Cache the Nix store, Rust `~/.cargo/registry`, and pnpm store with lockfile-based keys 2. **Concurrency cancellation** — Add `concurrency: { group: "${{ github.ref }}", cancel-in-progress: true }` to PR workflows 3. **Path-based triggers** — Use `paths:` filters so Rust-only changes don't trigger the full UI E2E suite and vice versa 4. **Matrix reduction** — Recommend only when a matrix leg is proven redundant and all required coverage remains 5. **Job parallelism or splitting** — Use observed durations to identify safe parallel work or split slow jobs; preserve every required check 6. **Duplicate workflow removal** — Merge overlapping jobs between `main.yml` and `test_all.yml` 7. **Redundant test detection** — Identify semantic overlap in test logic, not only textual repetition ## Step 4 — Verify If `gh` CLI is available, validate path-gating and concurrency cancellation with a dry-run check. If live validation is not possible, state that explicitly. ## Required Output 1. **Waste sources** — top cost/latency drivers found in step 1 2. **Proposed fixes** — top 3 (or all remaining) with supporting audit evidence 3. **Validation** — what was proven live vs. checked statically, and any remaining risk 4. **Impact** — observed runner time separately from clearly labeled estimates Do not conflate CI minutes with AI credits. Report token savings only when provider usage data was actually measured. **If shell or `gh` CLI access is unavailable:** request the user paste `.github/workflows/` contents and `gh run list --limit 10` output. Begin static-only responses with: "**Static-only analysis** (not confirmed with live runs)."