infra(ci): shave ~95s off pr.yml critical path (3 optimizations)

.github/workflows/pr.yml

@@ -98,7 +98,10 @@ jobs:
         env:
           discovery.type: single-node
           xpack.security.enabled: "false"
-          ES_JAVA_OPTS: "-Xms512m -Xmx512m"
+          # 256m heap is sufficient for the CI integration-test workload
+          # (small synthetic indexes, no concurrency); halving from 512m
+          # shaves ~10-15s off the service-container init wait.
+          ES_JAVA_OPTS: "-Xms256m -Xmx256m"
         ports:
           - 9200:9200
         options: >-
@@ -111,7 +114,9 @@ jobs:
         env:
           discovery.type: single-node
           DISABLE_SECURITY_PLUGIN: "true"
-          OPENSEARCH_JAVA_OPTS: "-Xms512m -Xmx512m"
+          # Matches elasticsearch above — 256m heap is sufficient for the
+          # CI integration-test workload.
+          OPENSEARCH_JAVA_OPTS: "-Xms256m -Xmx256m"
         ports:
           - 9201:9200
         options: >-
@@ -136,6 +141,20 @@ jobs:
       - name: Install project deps (frozen)
         run: uv sync --frozen
 
+      - name: Restore mypy + ruff caches
+        # Both tools maintain on-disk caches that they invalidate per-file
+        # internally — safe to persist across runs. Cold mypy takes ~27s; a
+        # warm cache typically completes in ~5s. Key on uv.lock + pyproject
+        # (dep / tool-config changes); fall back to any prior runner-OS cache.
+        uses: actions/cache@v4
+        with:
+          path: |
+            .mypy_cache
+            .ruff_cache
+          key: mypy-ruff-${{ runner.os }}-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+          restore-keys: |
+            mypy-ruff-${{ runner.os }}-
+
       - name: Write file-based secrets (CI parity with mounted-secrets pattern)
         # Pydantic Settings reads DATABASE_URL_FILE / POSTGRES_PASSWORD_FILE.
         # In CI we materialize them from the service-container env values.
@@ -349,7 +368,9 @@ jobs:
   docker:
     name: docker buildx (relyloop/api)
     runs-on: ubuntu-latest
-    needs: [backend, frontend]
+    # No `needs:` — buildx tests that the Dockerfile builds, which is
+    # independent of backend/frontend test outcomes. Running in parallel
+    # with the other jobs removes ~65s from the critical path.
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v6