Stop re-running the first-party Zig dependency setup

scripts/release-workflow.test.tsmodified+16-0

Changes to scripts/release-workflow.test.ts

		⋯99 linesShow the 99 lines above this hunk@@ -100,3 +100,19 @@ test('SBOM generation validates required documents before uploading artifacts',
100	100	expect(workflow.jobs['vulnerability-scan'].steps!.find(step => step.uses?.startsWith('actions/download-artifact@'))?.uses).toBe(artifactDownload)
101	101	expect(release.jobs['attach-release-sbom'].steps!.find(step => step.uses?.startsWith('actions/download-artifact@'))?.uses).toBe(artifactDownload)
102	102	})
	103	+
	104	+// A composite action under .github/actions is setup: it clones pinned
	105	+// dependencies, installs a toolchain, and returns early when the work is
	106	+// already done. Running one twice in a job is therefore always waste rather
	107	+// than intent, and it happens by accident when two pull requests insert steps
	108	+// into the same region. Repeating a published action can be deliberate --
	109	+// uploading two artifacts, say -- so only local ones are checked here.
	110	+test('no job runs the same local composite action twice', () => {
	111	+ for (const file of ['ci.yml', 'release.yml', 'sbom.yml', 'mobile-e2e.yml']) {
	112	+ const workflow = Bun.YAML.parse(readFileSync(join(import.meta.dir, '../.github/workflows/', file), 'utf8')) as { jobs: Record<string, Job> }
	113	+ for (const [name, job] of Object.entries(workflow.jobs)) {
	114	+ const local = (job.steps ?? []).map(step => step.uses).filter((uses): uses is string => uses?.startsWith('./') ?? false)
	115	+ expect(new Set(local).size, `${file} job ${name} repeats a local action: ${local.join(', ')}`).toBe(local.length)
	116	+ }
	117	+ }
	118	+})