chore(ci): optimize CI workflows

.github/workflows/check.yml

@@ -5,44 +5,81 @@ name: Check
 on:
   push:
     branches: [main]
+    paths:
+      - "distilled"
+      - "benchmark/**"
+      - "examples/**"
+      - "packages/**"
+      - "website/**"
+      - "scripts/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/check.yml"
   pull_request:
     types: [opened, reopened, synchronize]
+    paths:
+      - "distilled"
+      - "benchmark/**"
+      - "examples/**"
+      - "packages/**"
+      - "website/**"
+      - "scripts/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/check.yml"
   workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check:
     name: Check
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # pnpm needs the distilled submodule (workspace member)
-          submodules: true
-
-      - name: Setup pnpm, Node.js, Bun
-        uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
-        with:
-          cache: true
-          install: false
 
-      - name: Install Node 24
-        run: pnpm runtime set node 24 -g
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
 
       - name: Restore Astro build cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: website/node_modules/.astro
-          key: website-check-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}
+          key: website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
           restore-keys: |
-            website-check-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-
-            website-check-astro-${{ runner.os }}-main-
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-
+            website-astro-${{ runner.os }}-main-
 
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
 
       - name: Run Node Utils tests
         run: pnpm -C packages/node-utils test

.github/workflows/claude.yml

@@ -10,6 +10,12 @@ on:
   pull_request_review:
     types: [submitted]
 
+concurrency:
+  group: claude-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
+  # Separate @claude prompts may be independent requests; serialize them for
+  # the same issue or PR without discarding one that is already running.
+  cancel-in-progress: false
+
 jobs:
   claude:
     if: |
@@ -28,20 +34,26 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          submodules: true
           fetch-depth: 1
 
-      - name: Setup pnpm, Node.js, Bun
-        uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
-        with:
-          cache: true
-          install: false
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
 
-      - name: Install Node 24
-        run: pnpm runtime set node 24 -g
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
 
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
 
       - name: Configure AWS credentials
         id: aws

.github/workflows/cloudflare-tools.yml

@@ -3,13 +3,47 @@ name: Cloudflare Tools
 on:
   push:
     branches: [main]
+    paths:
+      - "distilled"
+      - "fixtures/**"
+      - "packages/cloudflare-runtime/**"
+      - "packages/cloudflare-test-tools/**"
+      - "packages/frontend-frameworks/**"
+      - "packages/node-utils/**"
+      - "scripts/copy-package-files.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/cloudflare-tools.yml"
   pull_request:
     types: [opened, reopened, synchronize]
+    paths:
+      - "distilled"
+      - "fixtures/**"
+      - "packages/cloudflare-runtime/**"
+      - "packages/cloudflare-test-tools/**"
+      - "packages/frontend-frameworks/**"
+      - "packages/node-utils/**"
+      - "scripts/copy-package-files.ts"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/cloudflare-tools.yml"
   workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: cloudflare-tools-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     # GitHub does not expose repository secrets to fork pull requests. Keep
@@ -30,21 +64,25 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          # pnpm needs the distilled submodule (workspace member)
-          submodules: true
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
 
-      - name: Setup pnpm, Node.js, Bun
-        uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
           cache: true
-          install: false
-
-      - name: Install Node 24
-        run: pnpm runtime set node 24 -g
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          install: true
+          require-lockfile: true
 
       - name: Typecheck
         run: pnpm typecheck:cloudflare-packages

.github/workflows/pr-package.yml

@@ -3,18 +3,44 @@ name: PR Package
 on:
   push:
     branches: [main]
+    paths:
+      - "distilled"
+      - "packages/**"
+      - "scripts/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/pr-package.yml"
   pull_request:
     # `labeled` so adding the `force-ci` label re-triggers the run. We
     # intentionally do NOT listen to `closed` — pr-package tags persist
     # past PR close so existing install URLs keep resolving.
     types: [opened, synchronize, reopened, labeled]
+    paths:
+      - "distilled"
+      - "packages/**"
+      - "scripts/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/pr-package.yml"
 
 # The action can't widen permissions, so the job must grant write access for
 # the sticky install-instructions comment.
 permissions:
   contents: read
   pull-requests: write
 
+concurrency:
+  group: pr-package-${{ github.ref }}
+  # A newer PR commit supersedes its preview packages. Never interrupt a main
+  # publish, where cancellation could leave only part of the package set live.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   pr-package:
     name: Publish PR preview packages
@@ -27,31 +53,29 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # pnpm needs the distilled submodule (workspace member)
-          submodules: true
           fetch-depth: 0
 
-      - name: Setup pnpm, Node.js, Bun
-        uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
-        with:
-          cache: true
-          install: false
-
-      - name: Install Node 24
-        run: pnpm runtime set node 24 -g
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
 
       - name: Restore Turbo cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .turbo
-          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.run_attempt }}
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
           restore-keys: |
             turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
             turbo-${{ runner.os }}-${{ github.repository_id }}-
 
+      # The root install runs Turbo-backed prepare builds, so restore its
+      # cache before the setup action installs dependencies.
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+        with:
+          cache: true
+          install: true
+          require-lockfile: true
+
       - name: Build packages
         run: pnpm build:pr-packages
 

.github/workflows/release.yml

@@ -52,19 +52,25 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ steps.bot-token.outputs.token }}
-          submodules: true
 
-      - name: Setup pnpm, Node.js, Bun
-        uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
+
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
+
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
           cache: true
-          install: false
-
-      - name: Install Node 24
-        run: pnpm runtime set node 24 -g
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          install: true
+          require-lockfile: true
 
       - id: release
         name: Prepare release
@@ -112,21 +118,20 @@ jobs:
         with:
           ref: ${{ needs.build.outputs.sha }}
           fetch-depth: 0
-          # pnpm needs the distilled submodule (workspace member); the root
-          # `prepare` script also builds distilled/packages/cloudflare.
-          submodules: true
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
 
       - name: Setup pnpm, Node.js, Bun
-        uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
           cache: true
           install: false
 
-      - name: Install Node 24
-        run: pnpm runtime set node 24 -g
-
+      # Release scripts import changelogithub, but publishing does not need
+      # package lifecycle scripts or the root Turbo-backed prepare build.
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
 
       - name: Remove token-based npm authentication
         run: sed -i '/always-auth/d' ~/.npmrc 2>/dev/null || true