improvement(ci): parallelize audit+prepare, add caching, share build artifacts

- Extract `prepare` job: install → build:packages → generate → rebuild.
  Uploads compiled dist/ + .mercato/generated/ as a reusable artifact so
  downstream jobs skip the repeated build+generate work.

- Extract `audit` job: runs in parallel with `prepare` rather than
  sequentially inside `test`, removing it from the critical path.

- `test` job now downloads the artifact instead of rebuilding packages.

- `ephemeral-integration` downloads the same artifact and skips
  install+build:packages×2+generate (was ~1m31s of duplicate work).

- Add `cache: 'yarn'` to all setup-node@v4 steps (~45s saved per job on
  warm cache hits).

- Add `actions/cache` for pip to avoid re-downloading markitdown on every run.

Measured baseline (run 24178370484): test 7m12s, ephemeral-integration 48m47s,
total wall ~55 min. Integration tests themselves account for 44m59s; sharding
across 3 Playwright workers (--shard=N/3) is the next lever — see comment in
the ephemeral-integration job for what that would require.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: yokoszn

.github/workflows/ci.yml

@@ -13,7 +13,11 @@ on:
       - develop
 
 jobs:
-  test:
+  # ── Shared build ────────────────────────────────────────────────────────────
+  # Installs deps, compiles all packages, and runs the code generator.
+  # Uploads the compiled dist/ + generated .mercato/ as an artifact so every
+  # downstream job can skip this work entirely.
+  prepare:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -23,19 +27,14 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24
+          cache: 'yarn'
 
       - name: Enable Corepack
         run: corepack enable
 
-      - name: Install markitdown CLI
-        run: python3 -m pip install --upgrade pip markitdown
-
       - name: Install dependencies
         run: yarn install --immutable
 
-      - name: Audit dependencies for known CVEs
-        run: yarn npm audit --all --recursive --severity high
-
       - name: Build packages
         run: yarn build:packages
 
@@ -45,6 +44,76 @@ jobs:
       - name: Rebuild packages with generated files
         run: yarn build:packages
 
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-artifacts
+          path: |
+            packages/*/dist/
+            apps/mercato/.mercato/generated/
+          retention-days: 1
+          if-no-files-found: error
+
+  # ── Security audit ──────────────────────────────────────────────────────────
+  # Runs in parallel with 'prepare' — only needs yarn install, not the full build.
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: 'yarn'
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Audit dependencies for known CVEs
+        run: yarn npm audit --all --recursive --severity high
+
+  # ── Quality checks ──────────────────────────────────────────────────────────
+  # Typechecking, unit tests, i18n sync, and the Next.js app build.
+  # Blocked on both 'prepare' (needs compiled packages) and 'audit' (security gate).
+  test:
+    runs-on: ubuntu-latest
+    needs: [prepare, audit]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: 'yarn'
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Cache pip packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: pip-markitdown-v1
+          restore-keys: pip-markitdown-
+
+      - name: Install markitdown CLI
+        run: python3 -m pip install --upgrade pip markitdown
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: build-artifacts
+
       - name: Check dependency version conflicts
         run: yarn check:dep-versions
 
@@ -64,6 +133,14 @@ jobs:
       - name: Build
         run: yarn build:app
 
+  # ── Integration tests ───────────────────────────────────────────────────────
+  # Boots an ephemeral app server and runs the full Playwright suite.
+  # Blocked on 'test' so integration only runs when unit tests are green.
+  #
+  # Performance note: at 311 spec files with workers: 1, this job accounts for
+  # ~45 of the ~55 min total wall time. Playwright sharding across 3 parallel
+  # runners (--shard=N/3) would cut this to ~16 min but requires each shard
+  # to start its own ephemeral server and a final step to merge coverage JSON.
   ephemeral-integration:
     runs-on: ubuntu-latest
     needs: test
@@ -81,21 +158,18 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24
+          cache: 'yarn'
 
       - name: Enable Corepack
         run: corepack enable
 
       - name: Install dependencies
         run: yarn install --immutable
 
-      - name: Build packages
-        run: yarn build:packages
-
-      - name: Prepare generated modules
-        run: yarn generate
-
-      - name: Rebuild packages with generated files
-        run: yarn build:packages
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: build-artifacts
 
       - name: Build app
         run: yarn workspace @open-mercato/app build
@@ -149,7 +223,7 @@ jobs:
             \`| Functions | \${t.functions?.covered ?? 0}/\${t.functions?.total ?? 0} | \${t.functions?.pct ?? 0}% |\`,
             \`| Branches | \${t.branches?.covered ?? 0}/\${t.branches?.total ?? 0} | \${t.branches?.pct ?? 0}% |\`,
             '',
-            'Source: `.ai/qa/test-results/coverage/code/coverage-summary.json`',
+            'Source: \`.ai/qa/test-results/coverage/code/coverage-summary.json\`',
             '',
           ].join('\n'));
           " "$SUMMARY_FILE"
@@ -165,6 +239,9 @@ jobs:
             .ai/qa/test-results/results.json
           if-no-files-found: ignore
 
+  # ── Docker image builds ──────────────────────────────────────────────────────
+  # Validates all Dockerfiles build cleanly. Runs in parallel with
+  # 'ephemeral-integration' (both need test), so it does not add to wall time.
   docker-build:
     runs-on: ubuntu-latest
     needs: test