ci: cut unchanged verification to 3.3 seconds

.github/workflows/main.yml

@@ -32,6 +32,14 @@ jobs:
           run-install: |
             - args: ["--frozen-lockfile"]
 
+      - name: Restore Vite Task cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: node_modules/.vite/task-cache
+          key: vite-task-${{ runner.os }}-${{ runner.arch }}-${{ github.sha }}
+          restore-keys: |
+            vite-task-${{ runner.os }}-${{ runner.arch }}-
+
       - run: pnpm exec vp run ready
 
   scan:

.github/workflows/verify.yml

@@ -34,4 +34,12 @@ jobs:
           run-install: |
             - args: ["--frozen-lockfile"]
 
+      - name: Restore Vite Task cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: node_modules/.vite/task-cache
+          key: vite-task-${{ runner.os }}-${{ runner.arch }}-${{ github.sha }}
+          restore-keys: |
+            vite-task-${{ runner.os }}-${{ runner.arch }}-
+
       - run: pnpm exec vp run ready

AGENTS.md

@@ -36,5 +36,7 @@ bootstrap/break-glass inject; never document vault paths in package docs.
 - Objects: raw `/o/<key>`, preview `/p/<key>`; put returns both `url` and `preview_url`.
 - Do not commit secrets, PEM private keys, account/D1 ids, or font binaries.
 - Prefer repo-scoped vite-plus via `pnpm exec vp` (never a global `vp`); wrangler for Worker deploy.
+- Use `pnpm run verify` for cached parallel verification and
+  `pnpm exec vp run --no-cache ready` to force every lane.
 - After `apps/api/wrangler.toml` binding/var changes: `pnpm --filter @uinaf/attach-api types` and commit the Env-only `worker-configuration.d.ts` (never the full runtime dump; CI checks freshness via `types:check`).
 - Prod CD: GitHub Environment `production`. Runtime secrets: Cloudflare.

CONTRIBUTING.md

@@ -14,9 +14,14 @@ Node (see `.node-version`) with Corepack enabled:
 
 ```sh
 ./scripts/verify.sh
-# equivalent: pnpm run verify → pnpm exec vp run ready
+# equivalent: pnpm run verify → vp run ready
+# force every lane: pnpm exec vp run --no-cache ready
 ```
 
+The repository-owned Vite Task graph runs formatting, linting, design checks,
+generated-type freshness, tests, and builds in parallel. Valid unchanged lanes
+are restored from the task cache; the forced command bypasses it.
+
 API Worker tests: Node characterization via vite-plus, plus
 `@cloudflare/vitest-pool-workers` (`pnpm --filter @uinaf/attach-api test:workers`).
 After `wrangler.toml` binding changes:

apps/api/package.json

@@ -8,9 +8,9 @@
     "check": "vp check",
     "types": "wrangler types --env-file .dev.vars.example --include-runtime=false --strict-vars=false",
     "types:check": "wrangler types --env-file .dev.vars.example --include-runtime=false --strict-vars=false --check",
-    "test": "vp test run && vitest run --config vitest.workers.config.ts",
-    "test:workers": "vitest run --config vitest.workers.config.ts",
-    "build": "wrangler deploy --dry-run --outdir=dist",
+    "test": "vp test run && vp run worker:test",
+    "test:workers": "vp run worker:test",
+    "build": "vp run worker:build",
     "deploy": "node ./scripts/deploy.ts",
     "db:migrate:local": "wrangler d1 migrations apply attach --local",
     "db:migrate:remote": "wrangler d1 migrations apply attach --remote"

apps/api/vite.config.ts

@@ -1,6 +1,21 @@
 import { defineConfig } from "vite-plus";
 
 export default defineConfig({
+  run: {
+    tasks: {
+      "worker:build": {
+        command: "wrangler deploy --dry-run --outdir=dist",
+        dependsOn: ["@uinaf/attach-web#build"],
+        input: [{ auto: true }, "!dist/**", "!.wrangler/**"],
+        output: ["dist/**"],
+      },
+      "worker:test": {
+        command: "vitest run --config vitest.workers.config.ts",
+        input: [{ auto: true }, "!.wrangler/**", "!node_modules/.vite/**"],
+        output: [],
+      },
+    },
+  },
   test: {
     include: ["test/**/*.test.ts"],
     exclude: ["test/workers/**"],

package.json

@@ -5,11 +5,10 @@
   "description": "Self-hosted Cloudflare kit for PR/validation media uploads",
   "type": "module",
   "scripts": {
-    "ready": "vp check && vp run -t @uinaf/attach-web#design:check && pnpm --filter @uinaf/attach-api types:check && vp run -r test && vp run -t @uinaf/attach-web#build && vp run -t @uinaf/attach-api#build && vp run -t @uinaf/attach-cli#build",
     "verify": "vp run ready",
-    "check": "vp check",
-    "test": "vp run -r test",
-    "build": "vp run -t @uinaf/attach-web#build && vp run -t @uinaf/attach-api#build && vp run -t @uinaf/attach-cli#build",
+    "check": "vp run checks",
+    "test": "vp run tests",
+    "build": "vp run builds",
     "dev": "vp run @uinaf/attach-web#dev",
     "deploy": "pnpm exec vp run -t @uinaf/attach-web#build && node apps/api/scripts/deploy.ts",
     "prepare": "vp config --no-agent"

packages/shared/test/shared.test.ts

@@ -35,6 +35,7 @@ describe("api keys", () => {
       expect(parsed?.keyId).toBe(minted.keyId);
       const hash = await hashApiKeySecret(minted.secret);
       expect(await verifyApiKeySecret(parsed!.secret, hash)).toBe(true);
+      expect(await verifyApiKeySecret(mintApiKey().secret, hash)).toBe(false);
     }
   });
 

vite.config.ts

@@ -22,5 +22,40 @@ export default defineConfig({
   },
   run: {
     cache: true,
+    tasks: {
+      builds: {
+        cache: false,
+        command: 'node -e ""',
+        dependsOn: [
+          "@uinaf/attach-api#build",
+          "@uinaf/attach-cli#build",
+          "@uinaf/attach-shared#build",
+          "@uinaf/attach-web#build",
+        ],
+      },
+      checks: {
+        cache: false,
+        command: 'node -e ""',
+        dependsOn: ["design", "format", "lint", "types"],
+      },
+      design: "vp run @uinaf/attach-web#design:check",
+      format: "vp fmt --check",
+      lint: "vp lint",
+      ready: {
+        cache: false,
+        command: 'node -e ""',
+        dependsOn: ["builds", "design", "format", "lint", "tests", "types"],
+      },
+      tests: {
+        cache: false,
+        command: 'node -e ""',
+        dependsOn: [
+          "@uinaf/attach-api#test",
+          "@uinaf/attach-cli#test",
+          "@uinaf/attach-shared#test",
+        ],
+      },
+      types: "pnpm --filter @uinaf/attach-api types:check",
+    },
   },
 });