Reduce total CI duration (#536)

## Description

Improves overall time spent for our CI checks to complete. For cache
hits, total time decreases from ~70min to ~29min.

## Overview

```mermaid
gantt
    title CI on a PR — BEFORE ~70m vs NOW ~29m
    dateFormat HH:mm
    axisFormat %M

    section BEFORE ~70m
    [release] build-wasm 20m                      :r1, 00:00, 20m
    [release] build-x86_64-apple-darwin 17m       :r2, 00:00, 17m
    [release] build-x86_64-pc-windows-msvc 11m    :r3, 00:00, 11m
    [release] build-x86_64-unknown-linux-musl 10m :r4, 00:00, 10m
    [release] build-aarch64-apple-darwin 8m       :r5, 00:00, 8m
    [release] create-macos-universal 14s          :r6, 00:17, 1m
    [test-wasm] own duplicate wasm build 19m      :w1, 00:00, 19m
    [test-wasm] test matrix 3m                    :w2, 00:19, 3m
    [test] required 12m                                            :crit, t1, 00:00, 12m
    [differential-tests] build matrix waits 8m for release         :crit, t2, 00:12, 8m
    [differential-tests] macos-x86_64 compile and hash 44m         :crit, t3, 00:20, 44m
    [differential-tests] windows-x86_64 compile and hash 26m       :t4, 00:20, 26m
    [differential-tests] linux-x86_64 compile and hash 20m         :t5, 00:20, 20m
    [differential-tests] macos-arm64 compile and hash 15m          :t6, 00:20, 15m
    [differential-tests] run-e2e-tests parallel 43m                :t7, 00:22, 43m
    [differential-tests] compare-hashes 5m                         :crit, t8, 01:04, 5m
    [hardhat] use-hardhat chained 1m                               :crit, t9, 01:09, 1m

    section NOW ~29m
    [release] build-windows 3m              :nr1, 00:00, 3m
    [release] build-x86_64-apple-darwin 7m  :nr2, 00:00, 7m
    [release] build-linux 2m                :nr3, 00:00, 2m
    [release] build-aarch64-apple-darwin 2m :nr4, 00:00, 2m
    [release] create-macos-universal 23s    :nr5, 00:07, 1m
    [release] build-wasm cache hit ~11s     :nr6, 00:15, 1m
    [test-wasm] shared wasm build 15m       :nw1, 00:00, 15m
    [test-wasm] test matrix 3m              :nw2, 00:15, 3m
    [test] required 6m                                              :crit, nt1, 00:00, 6m
    [test] check-changes 2s parallel                                :nt2, 00:00, 1m
    [differential-tests] per-target cache hits ~1m 30s              :crit, nt3, 00:06, 2m
    [differential-tests] windows-x86_64 compile and hash 19m        :crit, nt4, 00:08, 19m
    [differential-tests] linux-x86_64 compile and hash 16m          :nt5, 00:08, 16m
    [differential-tests] macos-arm64 compile and hash 13m           :nt6, 00:08, 13m
    [differential-tests] run-e2e-tests 16m                          :nt7, 00:08, 16m
    [differential-tests] compare-hashes 2m                          :crit, nt8, 00:27, 2m
    [hardhat] use-hardhat parallel 1m                               :nt9, 00:07, 1m
```

## Measurements

| Metric | Before | Now | Improvement |
|---|---|---|---|
| **PR CI wall-clock** | 70m 15s | 28m 47s | **−41m 28s (−59%)** |
| `test` job (required check) | 12m 10s | 6m 17s | −5m 53s (faster LLVM
download) |
| `compile-and-hash` build phase | ~7m 30s (waiting on release builds) |
~30s (builds already available) to ~1m 30s (if waiting for macos) |
−6-7m (per-target build split + faster LLVM download) |
| `run-e2e-tests` build phase | ~7m 30s (waiting on release builds) |
~30s (`linux-x86_64` already available) | −7m (per-target build split) |
| Longest `compile-and-hash` job | 44m 05s (`macos-x86_64`) | 19m 08s
(`windows-x86_64`) | −24m 57s (`macos-x86_64` excluded on PRs) |
| `compile-and-hash` matrix start time | 20m 13s | 7m 54s | −12m 19s
(per-target build split + faster LLVM download) |
| `run-e2e-tests` start time | 21m 50s | 7m 36s | −14m 14s (per-target
build split + faster LLVM download) |
| `run-e2e-tests` duration | 43m 28s | 16m 22s | −27m 06s (concurrency
bump + flakiness fix) |

## Changes

| Change | Before | Now |
|---|---|---|
| **Per-target build sub-workflows** | <ul><li>Getting a reusable build
depended on all builds completing.</li><li>Even if e.g. a macOS build is
cached, the waiting workflow with macOS runners could be queued for a
long time just to get the status and cache of the other workflow, since
macOS runners are more scarce than e.g. Ubuntu.</li></ul> |
<ul><li>Split umbrella `reusable-build.yml` into
`reusable-build-{linux,macos,windows,wasm}.yml`.</li><li>Consumers can
wait on a specific target and start earlier instead of blocking on the
whole matrix.</li><li>E.g. E2E and the compile-and-hash matrix start
earlier (gate only on the targets needed).</li></ul> |
| **Bottleneck macOS Intel only running on `main`** | macOS Intel
runners are 2-3× slower than macOS ARM for the contract compilation
tests. Ran on each PR, being the bottleneck. | This build is now
excluded from the matrix for PR runs, and only included for pushes to
`main`. |
| **E2E tests use higher concurrency** | `run-e2e-tests` duration:
~43min.</li></ul> | <ul><li>Uses higher number of concurrent tasks, made
possible by retester flakiness fix.</li><li>`run-e2e-tests` duration:
~16min.</li></ul> |
| **Faster LLVM downloads** | Building resolc took ~8-13min (~16 min on
macOS intel). | `get-llvm/action.yml` uses more efficient version
detection. Building resolc now takes ~2min (~4-7 min on macOS intel). |
| **Wasm tests use cached artifacts** | `test-wasm.yml` ran its own
duplicate build. | `test-wasm.yml` uses the reusable Wasm build. |
| **Skip unnecessary polkadot-sdk package** | For E2E tests,
`polkadot-omni-node` was unconditionally downloaded (~3-4min). | Only
`pallet-revive-eth-rpc` and `revive-dev-node` are downloaded from the
cache. |
| **Cache `report-processor`** | Only `retester` was cached. |
`report-processor` is cached for the compilations and export hashes
jobs. |
| **Hardhat unblocked from differential tests** | Started after the
differential tests succeeded in order to reuse the Linux build. | Starts
as soon as the required `test` job succeeds, using the reusable Linux
build. |
| **Conditionally skip workflows** | <ul><li>Some workflows
conditionally skipped for md-only changes.</li><li>Tooling-only changes
also ran e.g. `test-wasm.yml` and `differential-tests.yml`.</ul></li> |
<ul><li>Most workflows are skipped for doc-only
updates.</li><li>Tooling-only updates trigger only the respective
tooling test (Hardhat), apart from the required `test`
job.</li><li>Differential tests are skipped for js-only
updates.</li></ul> |
| **Miscellaneous** | <ul><li>Used actions running on soon-deprecated
Node 20.</li><li>Difficult to debug Playwright `test-wasm`
failures.</li></ul> | <ul><li>Upgraded actions that used Node
20.</li><li>Added Playwright debug traces uploaded on `test-wasm`
failures.</li></ul> |

## Resolved Issues

Closes #533

.github/actions/build-resolc/action.yml

@@ -0,0 +1,88 @@
+name: Build resolc
+description: Cache-aware resolc build for a single target.
+
+inputs:
+  target:
+    description: "Target triple (e.g., x86_64-unknown-linux-musl)"
+    required: true
+  build-type:
+    description: "'native' or 'musl'"
+    required: true
+  retention-days:
+    description: "Artifact retention in days"
+    required: false
+    default: "1"
+
+outputs:
+  url:
+    description: "Uploaded artifact URL"
+    value: ${{ steps.upload.outputs.artifact-url }}
+  sha:
+    description: "Uploaded artifact digest"
+    value: ${{ steps.upload.outputs.artifact-digest }}
+
+runs:
+  using: composite
+  steps:
+    - name: Check Build Cache
+      id: cache
+      uses: actions/cache@v5
+      with:
+        # Use glob to match binaries with and without extensions.
+        path: resolc-${{ inputs.target }}*
+        key: build-${{ inputs.target }}-${{ github.sha }}
+
+    - name: Set Up Rust Toolchain
+      if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+      uses: actions-rust-lang/setup-rust-toolchain@v1
+      with:
+        rustflags: ""
+        cache-key: ${{ inputs.target }}
+
+    - name: Download LLVM
+      if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+      uses: ./.github/actions/get-llvm
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Build (Native)
+      if: ${{ steps.cache.outputs.cache-hit != 'true' && inputs.build-type == 'native' }}
+      shell: bash
+      run: |
+        export LLVM_SYS_221_PREFIX=$PWD/llvm-${{ inputs.target }}
+        make install-bin
+        mv target/release/resolc resolc-${{ inputs.target }} || mv target/release/resolc.exe resolc-${{ inputs.target }}.exe
+
+    - name: Build (MUSL)
+      if: ${{ steps.cache.outputs.cache-hit != 'true' && inputs.build-type == 'musl' }}
+      shell: bash
+      env:
+        RUST_MUSL_CROSS_IMAGE: messense/rust-musl-cross@sha256:2a8837c43bf12e246f1ebd05191de9ee27fcd22f9ca81511ccd4cf75dc16d71c
+      run: |
+        docker run -v $PWD:/opt/revive $RUST_MUSL_CROSS_IMAGE /bin/bash -c "
+         cd /opt/revive
+         chown -R root:root .
+         apt update && apt upgrade -y && apt install -y pkg-config
+         export LLVM_SYS_221_PREFIX=/opt/revive/llvm-${{ inputs.target }}
+         make install-bin
+         mv target/${{ inputs.target }}/release/resolc resolc-${{ inputs.target }}
+         "
+        sudo chown -R $(id -u):$(id -g) .
+
+    - name: Install Solc
+      uses: ./.github/actions/get-solc
+
+    - name: Basic Sanity Check
+      shell: bash
+      run: |
+        result=$(./resolc-${{ inputs.target }} --bin crates/integration/contracts/flipper.sol)
+        echo $result
+        if [[ $result == *'50564d'* ]]; then exit 0; else exit 1; fi
+
+    - name: Upload Artifact
+      id: upload
+      uses: actions/upload-artifact@v6
+      with:
+        name: resolc-${{ inputs.target }}
+        path: resolc-${{ inputs.target }}*
+        retention-days: ${{ inputs.retention-days }}

.github/actions/get-llvm/action.yml

@@ -4,13 +4,12 @@
 #           target: x86_64-unknown-linux-gnu
 
 name: "Download LLVM"
+description: "Downloads a prebuilt LLVM release for a specific target."
+
 inputs:
   target:
+    description: "Target triple (e.g., x86_64-unknown-linux-musl)"
     required: true
-  version:
-    description: "LLVM release version (e.g., 'llvm-18.1.8'). If not specified, uses the latest published LLVM release. To test a specific draft release, use the full name (e.g. 'llvm-21.1.8-revive.0f80912')."
-    required: false
-    default: ""
 
 runs:
   using: "composite"
@@ -18,29 +17,39 @@ runs:
     - name: detect llvm version from submodule
       id: detect-version
       shell: bash
+      env:
+        # To test a draft LLVM release across every CI workflow, set this to the full
+        # draft name (e.g. "llvm-21.1.8-revive.0f80912") and revert to "" before merging.
+        OVERRIDE_VERSION: ""
       run: |
-        if [ -z "${{ inputs.version }}" ]; then
-          # Get the full version from the LLVM submodule.
-          git submodule update --init --recursive
-          cd llvm
-          # Try to get the most recent tag (e.g., "llvmorg-18.1.8")
-          LLVM_TAG=$(git describe --tags --abbrev=0 2>/dev/null)
-          if [ -n "$LLVM_TAG" ]; then
-            echo "Detected LLVM version from submodule: $LLVM_TAG"
-            # Convert "llvmorg-x.y.z" to "llvm-x.y.z"
-            LLVM_VERSION=$(echo "$LLVM_TAG" | sed 's/^llvmorg-/llvm-/')
-            echo "Detected LLVM version from submodule: $LLVM_VERSION"
-            echo "version_prefix=$LLVM_VERSION" >> $GITHUB_OUTPUT
-          else
-            echo "Could not detect LLVM version from submodule, will use latest release"
-            echo "version_prefix=" >> $GITHUB_OUTPUT
-          fi
-          cd ..
-        else
-          echo "Using explicitly provided version: ${{ inputs.version }}"
-          echo "version_prefix=${{ inputs.version }}" >> $GITHUB_OUTPUT
+        set -euo pipefail
+
+        if [ -n "${OVERRIDE_VERSION}" ]; then
+          echo "Using override version: ${OVERRIDE_VERSION}"
+          echo "version_prefix=${OVERRIDE_VERSION}" >> "$GITHUB_OUTPUT"
+          exit 0
         fi
 
+        LLVM_SHA=$(git ls-tree HEAD llvm | awk '{print $3}')
+        echo "LLVM_SHA: $LLVM_SHA"
+        LLVM_URL=$(git config -f .gitmodules submodule.llvm.url)
+        echo "LLVM_URL: $LLVM_URL"
+        if [ -z "$LLVM_SHA" ] || [ -z "$LLVM_URL" ]; then
+          echo "::error::Could not resolve LLVM submodule SHA or URL from this repo." >&2
+          exit 1
+        fi
+
+        # Do a treeless clone to avoid unnecessarily fetching source files.
+        git clone --filter=tree:0 --no-checkout "$LLVM_URL" llvm-tmp
+        # Try to get the most recent tag (e.g., "llvmorg-18.1.8").
+        LLVM_TAG=$(git -C llvm-tmp describe --tags --abbrev=0 "$LLVM_SHA")
+        rm -rf llvm-tmp
+
+        # Convert "llvmorg-x.y.z" to "llvm-x.y.z".
+        LLVM_VERSION=$(echo "$LLVM_TAG" | sed 's/^llvmorg-/llvm-/')
+        echo "Detected LLVM version from submodule pin: $LLVM_VERSION"
+        echo "version_prefix=$LLVM_VERSION" >> "$GITHUB_OUTPUT"
+
     - name: find asset
       id: find
       uses: actions/github-script@v7
@@ -56,6 +65,11 @@ runs:
           let target = process.env.target
           let versionPrefix = process.env.version_prefix
 
+          if (!versionPrefix) {
+            core.setFailed("version_prefix env is missing");
+            return;
+          }
+
           // Fetch all releases from all pages
           core.info('Fetching releases from revive repository...');
           let hasMorePages = true;
@@ -88,43 +102,24 @@ runs:
             core.info(`  - ${r.tag_name} (published: ${r.published_at})`);
           });
 
-          // Find the appropriate LLVM release
-          let llvmRelease;
-          if (versionPrefix) {
-            // Search for latest release matching the version prefix
-            llvmRelease = llvmReleases.find(release => {
-              return release.tag_name.startsWith(versionPrefix);
-            });
-            if (llvmRelease) {
-              core.info(`Selected LLVM release matching prefix '${versionPrefix}': ${llvmRelease.tag_name}`);
-            }
-          } else {
-            // Find latest LLVM release (first in sorted list)
-            llvmRelease = llvmReleases[0];
-            if (llvmRelease) {
-              core.info(`Selected latest LLVM version: ${llvmRelease.tag_name}`);
-            }
+          // Find the latest LLVM release matching the version prefix.
+          const llvmRelease = llvmReleases.find(release => release.tag_name.startsWith(versionPrefix));
+          if (!llvmRelease) {
+            core.setFailed(`No LLVM releases matching prefix '${versionPrefix}' found! Please check the version, or first release LLVM`);
+            return;
           }
 
-          if (llvmRelease) {
-            let asset = llvmRelease.assets.find(asset => {
-              return asset.name.includes(target);
-            });
-            if (!asset) {
-              core.setFailed(`Artifact for '${target}' not found in release ${llvmRelease.tag_name} (${llvmRelease.html_url})`);
-              process.exit();
-            }
-            // Use the API URL (rather than `browser_download_url`) so that
-            // the authorization header is respected for draft releases.
-            return asset.url;
+          core.info(`Selected LLVM release matching prefix '${versionPrefix}': ${llvmRelease.tag_name}`);
+
+          const asset = llvmRelease.assets.find(asset => asset.name.includes(target));
+          if (!asset) {
+            core.setFailed(`Artifact for '${target}' not found in release ${llvmRelease.tag_name} (${llvmRelease.html_url})`);
+            return;
           }
 
-          if (versionPrefix) {
-            core.setFailed(`No LLVM releases matching prefix '${versionPrefix}' found! Please check the version.`);
-          } else {
-            core.setFailed(`No LLVM releases found! Please release LLVM before running this workflow.`);
-          }
-          process.exit();
+          // Use the API URL (rather than `browser_download_url`) so that
+          // the authorization header is respected for draft releases.
+          return asset.url;
 
     - name: download
       shell: bash