ci: optimize workflow for performance and efficiency

[Copilot]

Several CI inefficiencies: missing timeouts on two jobs, no pip caching, release builds sharing a debug cache key, env polluter loop running unconditionally on empty lists, and commented-out dead code.

Triggers

• Add paths-ignore (**.md, docs/**, LICENSE) to push and pull_request to skip full CI on doc-only changes

Timeouts

• lint: add timeout-minutes: 15
• cargo_check: add timeout-minutes: 30

Caching

• snippets_cpython rust-cache: add shared-key: release-${{ matrix.os }} to isolate release artifacts from debug cache
• snippets_cpython + wasm: add cache: 'pip' with cache-dependency-path to actions/setup-python

snippets_cpython env polluter step

Skip entirely when the list is empty (currently always the case):

- name: run cpython tests to check if env polluters have stopped polluting
  if: ${{ join(matrix.env_polluting_tests, '') != '' }}

Dead code

Remove commented-out tkinter install/build steps (rust_tests) and Redox compilation steps (cargo_check).

Original prompt

Optimize .github/workflows/ci.yaml for performance and efficiency

Apply the following optimizations to the CI workflow at .github/workflows/ci.yaml:

1. Add paths-ignore to triggers

Add paths-ignore for documentation-only changes (**.md, docs/**, LICENSE) to both push and pull_request triggers so the full CI suite is skipped for doc-only changes.

2. Add missing timeout-minutes to lint and cargo_check jobs

• lint: add timeout-minutes: 15
• cargo_check: add timeout-minutes: 30

3. Separate release cache key in snippets_cpython

In the snippets_cpython job, the Swatinem/rust-cache step should use a shared-key to distinguish release builds from debug builds:

- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
  with:
    save-if: ${{ github.ref == 'refs/heads/main' }}
    shared-key: release-${{ matrix.os }}

4. Cache pip dependencies in snippets_cpython

In the snippets_cpython job, add pip caching to the actions/setup-python step:

- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
    python-version: ${{ env.PYTHON_VERSION }}
    cache: 'pip'
    cache-dependency-path: extra_tests/requirements.txt

5. Skip env polluter loop when list is empty

Add a condition to the "run cpython tests to check if env polluters have stopped polluting" step so it is skipped when matrix.env_polluting_tests is empty:

- name: run cpython tests to check if env polluters have stopped polluting
  if: ${{ join(matrix.env_polluting_tests, '') != '' }}
  shell: bash
  run: |
    ...

6. Remove commented-out code blocks

Remove the following commented-out blocks that add cognitive overhead:

• The commented-out "Install tk-dev for tkinter build" step and "Test tkinter build" step in the rust_tests job
• The commented-out "Prepare repository for redox compilation" and "Check compilation for Redox" steps in the cargo_check job

7. Use browser-actions/setup-geckodriver instead of manual wget in the wasm job

Replace the manual geckodriver download:

# Replace this:
- name: install geckodriver
  run: |
    wget https://github.com/mozilla/geckodriver/releases/download/v0.36.0/geckodriver-v0.36.0-linux64.tar.gz
    mkdir geckodriver
    tar -xzf geckodriver-v0.36.0-linux64.tar.gz -C geckodriver

With a proper action (use a recent pinned version of browser-actions/setup-geckodriver):

- uses: browser-actions/setup-geckodriver@abea85e42a1a4daaad52810b92e47afbc4e1eec7  # v0.4
  with:
    geckodriver-version: '0.36.0'

Also update the test step that references geckodriver to use the action's path. The driver_path line in the "run test" step should use the standard location that setup-geckodriver provides (it adds geckodriver to PATH automatically), so simplify:

- name: run test
  run: |
    npm install
    npm run test
  env:
    NODE_OPTIONS: "--openssl-legacy-provider"
  working-directory: ./wasm/demo

8. Cache pip in the wasm job

Add pip caching to the actions/setup-python step in the wasm job:

- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
  with:
    python-version: ${{ env.PYTHON_VERSION }}
    cache: 'pip'
    cache-dependency-path: wasm/tests/requirements.txt

Important Notes

• Keep ALL existing action SHAs/pins unchanged (except for the geckodriver change).
• Keep all existing job logic, step ordering, and conditional expressions intact unless explicitly changed above.
• Do NOT restructure jobs or split them — only apply the specific changes listed above.
• Make sure the YAML is valid after all changes.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: You are an expert CI/CD performance and efficiency advisor. Your task is to
analyze GitHub Actions workflows for OSS repositories, identify waste,
and produce actionable optimization advisory reports.

Can you review this yml file and suggest improvements

Assistant:

CI Workflow Optimization Report for insop/RustPython

I've reviewed the ci.yaml workflow thoroughly. Here's my analysis organized by impact category.

---

🔴 High Impact Optimizations

1. Missing dependency caching for wasm-pack, geckodriver, and cargo-binstall artifacts

The wasm job downloads geckodriver and wasm-pack via curl/wget on every run. The lint job uses cargo-binstall to install cargo-shear every time.

Recommendation: Cache these or use pinned GitHub Actions where available.

# Instead of curl for wasm-pack:
- uses: cargo-bins/cargo-binstall@113a77a4ce971c41332f2129c3d995df993cf746
- run: cargo binstall --no-confirm wasm-pack

# Instead of wget for geckodriver, use a dedicated action:
- uses: browser-actions/setup-geckodriver@v0.3
  with:
    geckodriver-version: '0.36.0'

2. **snippets_cpython builds in --release mo...

This pull request was created from Copilot chat.

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[insop]

@copilot

Check the WASM package and demo
Unable to resolve action browser-actions/setup-geckodriver@abea85e42a1a4daaad52810b92e47afbc4e1eec7, unable to find version abea85e42a1a4daaad52810b92e47afbc4e1eec7

[Copilot]

@copilot

Check the WASM package and demo
...

Fixed in 8d3d3cb. The SHA abea85e42a1a4daaad52810b92e47afbc4e1eec7 didn't exist in the browser-actions/setup-geckodriver repo. Updated to the correct latest commit SHA 01983cba585474556f36f12da47225cd94b330b9.

[insop]

@copilot

Still failing?
Check the WASM package and demo
File not found: '/home/runner/work/_actions/browser-actions/setup-geckodriver/01983cba585474556f36f12da47225cd94b330b9/index.js'

[Copilot]

@copilot

Still failing?
...

Fixed in 0e270f2. The browser-actions/setup-geckodriver action doesn't have proper release tags — only a pre-release v0.0.0 — and the compiled dist/index.js is missing at source commit SHAs. Reverted to the original manual wget/tar approach with the driver_path PATH export, which is simple and reliable.