ci: reuse the primary Linux build

.github/workflows/ci.yml

@@ -28,33 +28,14 @@ env:
 jobs:
 
   # Three enterprise jobs isolate coverage, static analysis, and the
-  # build-backed consumer tail so setup and build variance cannot serialize
-  # otherwise independent primary Node paths.
+  # build-backed consumer tail. The static job publishes its exact build so
+  # consumers do not repeat the longest part of their critical path.
   node-24:
     if: github.event_name == 'pull_request'
-    runs-on: ${{ matrix.runner }}
-    name: ${{ matrix.name }}
+    runs-on: dsh-enterprise-ubuntu-latest-32core-test
+    name: node 24 / static
     env:
-      DSH_COVERAGE_MAX_WORKERS: '24'
-      DSH_ESLINT_CACHE: '1'
-      DSH_ESLINT_CONCURRENCY: '8'
       DSH_GATE_CONCURRENCY: '8'
-      DSH_NODE_COMPAT_SKIP_TYPECHECK: '1'
-      DSH_PUBLINT_CONCURRENCY: '8'
-      DSH_SNAPSHOT_MAX_CONCURRENCY: '32'
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - lane: static
-            name: node 24 / static
-            runner: dsh-enterprise-ubuntu-latest-32core-test
-          - lane: snapshots-artifacts
-            name: node 24 / snapshots and artifacts
-            runner: dsh-enterprise-ubuntu-latest-32core-test
-          - lane: coverage
-            name: node 24 / coverage
-            runner: dsh-enterprise-ubuntu-24-04-32core-test
     steps:
       - uses: actions/checkout@v6
         with:
@@ -69,8 +50,104 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-
 
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.PRIMARY_NODE_VERSION }}
+
+      - name: Enable corepack and install dependencies
+        run: |
+          corepack enable
+          pnpm install --frozen-lockfile
+
+      - name: Run static gates
+        run: pnpm run check:ci:static
+
+      - name: Pack built tree
+        run: >-
+          tar -czf "$RUNNER_TEMP/node-24-built-tree.tar.gz"
+          apps/*/lib packages/*/*/lib vendor/*/lib
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: node-24-built-tree
+          path: ${{ runner.temp }}/node-24-built-tree.tar.gz
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+  node-24-coverage:
+    if: github.event_name == 'pull_request'
+    runs-on: dsh-enterprise-ubuntu-24-04-32core-test
+    name: node 24 / coverage
+    env:
+      DSH_COVERAGE_MAX_WORKERS: '24'
+      DSH_GATE_CONCURRENCY: '8'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - uses: actions/cache/restore@v4
+        with:
+          path: /home/runner/.local/share/pnpm/store/v11
+          key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.PRIMARY_NODE_VERSION }}
+
+      - name: Enable corepack, install dependencies, and prepare bubblewrap
+        run: |
+          corepack enable
+          pnpm install --frozen-lockfile &
+          install_pid=$!
+          bash scripts/prepare-ci-bubblewrap.sh &
+          sandbox_pid=$!
+          install_status=0
+          wait "$install_pid" || install_status=$?
+          sandbox_status=0
+          wait "$sandbox_pid" || sandbox_status=$?
+          if (( install_status != 0 )); then exit "$install_status"; fi
+          exit "$sandbox_status"
+
+      - name: Run exhaustive coverage
+        run: pnpm run check:ci:coverage
+
+  node-24-consumers:
+    needs: node-24
+    if: github.event_name == 'pull_request'
+    runs-on: dsh-enterprise-ubuntu-latest-32core-test
+    name: node 24 / snapshots and artifacts
+    env:
+      DSH_ESLINT_CACHE: '1'
+      DSH_ESLINT_CONCURRENCY: '8'
+      DSH_GATE_CONCURRENCY: '8'
+      DSH_NODE_COMPAT_SKIP_TYPECHECK: '1'
+      DSH_PUBLINT_CONCURRENCY: '8'
+      DSH_SNAPSHOT_MAX_CONCURRENCY: '32'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@v8
+        with:
+          name: node-24-built-tree
+          path: ${{ runner.temp }}
+
+      - name: Restore built tree
+        run: tar -xzf "$RUNNER_TEMP/node-24-built-tree.tar.gz"
+
+      - uses: actions/cache/restore@v4
+        with:
+          path: /home/runner/.local/share/pnpm/store/v11
+          key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-
+
       - uses: actions/cache/restore@v4
-        if: matrix.lane == 'snapshots-artifacts'
         with:
           path: .cache/eslint
           key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-eslint-full-${{ hashFiles('pnpm-lock.yaml', 'eslint.config.mjs', 'tsconfig.json', 'tsconfig.base.json', 'tsconfig.base.client.json', 'tsconfig.host.json', 'tsconfig.client.json', 'packages/*/*/tsconfig.json', 'examples/*/tsconfig.json') }}
@@ -95,15 +172,8 @@ jobs:
           if (( install_status != 0 )); then exit "$install_status"; fi
           exit "$sandbox_status"
 
-      - name: Run static gates
-        if: matrix.lane == 'static'
-        run: pnpm run check:ci:static
-
-      - name: Build and run compatibility, snapshot, and artifact gates
-        if: matrix.lane == 'snapshots-artifacts'
+      - name: Run compatibility, snapshot, and artifact gates
         run: |
-          pnpm run build
-
           pnpm run check:ci:lint &
           lint_pid=$!
           pnpm run check:node-compat &
@@ -142,10 +212,6 @@ jobs:
           done
           exit "$final_status"
 
-      - name: Run exhaustive coverage
-        if: matrix.lane == 'coverage'
-        run: pnpm run check:ci:coverage
-
 
   node-compat:
     if: github.event_name == 'pull_request'
@@ -621,7 +687,7 @@ jobs:
   all-checks-passed:
     name: all checks passed
     runs-on: ubuntu-latest
-    needs: [node-24, node-compat, python-sdk, windows]
+    needs: [node-24, node-24-coverage, node-24-consumers, node-compat, python-sdk, windows]
     if: always() && github.event_name == 'pull_request'
     steps:
       - name: Fail if any needed job did not succeed