Stop re-running the first-party Zig dependency setup

.github/workflows/ci.ymlmodified+0-3

Changes to .github/workflows/ci.yml

		⋯64 linesShow the 64 lines above this hunk@@ -65,9 +65,6 @@ jobs:
65	65	VERSION="$(bun -p "require('./package.json').version")"
66	66	bun scripts/verify-native-startup.ts packages/zig/zig-out/bin/craft "$VERSION"
67	67
68		- - name: First-party Zig dependencies
69		- uses: ./.github/actions/first-party-zig-deps
70		-
71	68	- name: Test Zig core
72	69	working-directory: packages/zig
73	70	run: zig build test

.github/workflows/release.ymlmodified+0-6

Changes to .github/workflows/release.yml

		⋯88 linesShow the 88 lines above this hunk@@ -89,9 +89,6 @@ jobs:
89	89	run: bun run build:core
90	90
91	91	# ── Cross-compile all targets ────────────────────────────────
92		- - name: First-party Zig dependencies
93		- uses: ./.github/actions/first-party-zig-deps
94		-
95	92	- name: Cross-compile additional targets (macOS)
96	93	if: runner.os == 'macOS'
97	94	working-directory: packages/zig
		⋯56 linesShow the 56 lines above this hunk@@ -154,9 +151,6 @@ jobs:
154	151	check zig-out/bin/craft
155	152	check zig-out/cross/darwin-x64/craft
156	153
157		- - name: First-party Zig dependencies
158		- uses: ./.github/actions/first-party-zig-deps
159		-
160	154	- name: Cross-compile additional targets (Linux)
161	155	if: runner.os == 'Linux'
162	156	working-directory: packages/zig

scripts/release-workflow.test.tsmodified+16-0

Changes to scripts/release-workflow.test.ts

		⋯99 linesShow the 99 lines above this hunk@@ -100,3 +100,19 @@ test('SBOM generation validates required documents before uploading artifacts',
100	100	expect(workflow.jobs['vulnerability-scan'].steps!.find(step => step.uses?.startsWith('actions/download-artifact@'))?.uses).toBe(artifactDownload)
101	101	expect(release.jobs['attach-release-sbom'].steps!.find(step => step.uses?.startsWith('actions/download-artifact@'))?.uses).toBe(artifactDownload)
102	102	})
	103	+
	104	+// A composite action under .github/actions is setup: it clones pinned
	105	+// dependencies, installs a toolchain, and returns early when the work is
	106	+// already done. Running one twice in a job is therefore always waste rather
	107	+// than intent, and it happens by accident when two pull requests insert steps
	108	+// into the same region. Repeating a published action can be deliberate --
	109	+// uploading two artifacts, say -- so only local ones are checked here.
	110	+test('no job runs the same local composite action twice', () => {
	111	+ for (const file of ['ci.yml', 'release.yml', 'sbom.yml', 'mobile-e2e.yml']) {
	112	+ const workflow = Bun.YAML.parse(readFileSync(join(import.meta.dir, '../.github/workflows/', file), 'utf8')) as { jobs: Record<string, Job> }
	113	+ for (const [name, job] of Object.entries(workflow.jobs)) {
	114	+ const local = (job.steps ?? []).map(step => step.uses).filter((uses): uses is string => uses?.startsWith('./') ?? false)
	115	+ expect(new Set(local).size, `${file} job ${name} repeats a local action: ${local.join(', ')}`).toBe(local.length)
	116	+ }
	117	+ }
	118	+})