ci: speed up the Windows build - #2397

.github/workflows/ci-windows-full.yml (3)

23-25: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Add an explicit permissions block and persist-credentials: false.

Neither the workflow nor the build-windows-full job sets a permissions block (CodeQL flags this for the whole job), so GITHUB_TOKEN defaults to broad permissions it doesn't need for a pure build job. The checkout step also doesn't set persist-credentials: false (zizmor's artipacked warning), leaving the token persisted in the local git config for the rest of the job.

🔒 Proposed fix

 jobs:
   build-windows-full:
     runs-on: windows-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-windows-full.yml around lines 23 - 25, The
build-windows-full job currently relies on the default broad GITHUB_TOKEN scope
and keeps checkout credentials persisted. Add an explicit permissions block to
the workflow or job with the minimum required access for this build, and update
the checkout step to disable credential persistence. Use the build-windows-full
job and its actions/checkout@v3 step as the place to make these changes.

Source: Linters/SAST tools

---

29-29: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Corepack version isn't pinned here, unlike the main job.

The main job pins corepack@0.31.0 before enabling it, but this new job (and build-windows in ci.yml) just runs bare corepack enable. Across OS planes this can silently resolve to a different corepack version, undermining reproducibility of the "real Windows build" this job exists for.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-windows-full.yml at line 29, The Windows workflow is
enabling Corepack without pinning the version, which can make the build
non-reproducible across OS planes. Update the new job’s Corepack setup to match
the pinned approach used in the main job, and apply the same change to the
build-windows job in ci.yml; use the existing corepack enable step as the place
to swap in the pinned corepack@0.31.0 invocation.

---

17-19: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Concurrency group keyed on sha won't dedupe across separate nightly runs.

This workflow only fires on schedule/workflow_dispatch, so github.event.number is always empty and the group always falls back to github.sha. That means two manual dispatches on the same commit will cancel each other, but a nightly cron run and a same-day manual dispatch on a different commit (or an overrunning previous nightly run) won't be deduplicated at all. For a singleton "full build" workflow, a fixed group name better expresses the intent of allowing only one full Windows build at a time.

 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
+  group: ${{ github.workflow }}
   cancel-in-progress: true

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-windows-full.yml around lines 17 - 19, The concurrency
settings for this full Windows workflow are using github.sha as a fallback,
which makes the dedupe behavior depend on commit identity instead of the
workflow itself. Update the concurrency group in ci-windows-full.yml to use a
fixed singleton group name for this workflow so any schedule or manual run
shares the same lock and only one full Windows build can run at a time; keep the
existing cancel-in-progress behavior and adjust the group expression near the
concurrency block.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes