ci: parallelize and strengthen package validation (#721)

#### Overview

Improve CI throughput and artifact confidence by parallelizing independent work, unifying matrices, and adding musl and downstream package validation.

- [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license.
- [x] I searched existing issues and open pull requests, and this does not duplicate existing work.

#### Details

- Run language workflows, checks, license validation, packaging, and tests in parallel where dependencies allow.
- Enable fail-fast consistently and consolidate repeated platform matrices and installer checks.
- Scope caches by platform target, including distinct glibc and musl cache keys.
- Test Rust core, Python, and Node on musl for amd64 and ARM64.
- Run musl Rust tests through the same `just --set ci true test-rust` path as native platforms, including locked nextest execution and JUnit output.
- Install the centrally pinned `uv`, `just`, and `cargo-nextest` versions inside the musllinux runtime; retain the existing musl coverage exclusion.
- Make the shared `just` helpers honor an explicit `UV_PYTHON` interpreter so PyO3 uses Alpine's shared Python instead of another interpreter bundled in the musllinux image.
- Add downstream smoke validation for Python wheels/source packages and Rust CLI artifacts.
- Use `npm ci` and Cargo/Maturin locked dependency resolution in musl validation paths.
- Infer musl behavior from the platform name instead of maintaining a separate matrix boolean.

Validation:

- `uv run pre-commit run --all-files`
- Targeted GitHub Actions/actionlint and workflow matrix contract checks
- YAML parsing, `just` recipe dry-run, and `git diff --check`
- Verified pinned `uv`, `just`, and `cargo-nextest` downloads for x86_64 and ARM64 musl
- Verified a missing explicit `UV_PYTHON` fails immediately and a valid explicit interpreter completes `just build-rust`
- Exercised the shared locked nextest path locally: 3,842 tests passed; eight FFI tests observed a personal ancestor `.nemo-relay/plugins.toml` and failed their clean-environment assertions
- Maturin locked-option checks, Node script syntax validation, and locked Cargo metadata validation

Docker is unavailable locally, so the complete musllinux container paths will run in GitHub Actions.

#### Where should the reviewer start?

Start with `.github/workflows/ci.yaml` for the top-level dependency graph, then review `.github/workflows/ci_rust.yml` and the shared Python resolver in `justfile` for the unified native/musl Rust test entrypoint.

#### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

- Relates to: none




## Summary by CodeRabbit

- **New Features**
  - Added automated validation for Linux, macOS, Windows, and musllinux package builds.
  - Added smoke tests for native packages, musllinux wheels, source distributions, plugin SDK wheels, and compiled artifacts.
  - Added checks confirming packaged CLI versions match expected releases.

- **Bug Fixes**
  - Improved cross-platform installer and package testing, including Windows PowerShell validation.
  - Strengthened failure handling so test failures are detected promptly.

- **Chores**
  - Improved package reproducibility by honoring locked dependencies during builds.
  - Improved Python interpreter selection through optional environment configuration.

Authors:
  - Will Killian (https://github.com/willkill07)

Approvers:
  - Eric Evans II (https://github.com/ericevans-nv)

URL: #721

Author: willkill07

.github/workflows/ci.yaml

@@ -125,12 +125,11 @@ jobs:
 
   ci_license_diff:
     name: License Diff
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_license_diff.yml
     if: >-
       ${{
         needs.prepare.outputs.is_pr == 'true'
-        && needs.ci_check.result == 'success'
         && needs.ci_changes.outputs.run_dependencies == 'true'
       }}
     permissions:
@@ -142,9 +141,9 @@ jobs:
 
   ci_rust:
     name: Rust
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_rust.yml
-    if: ${{ needs.ci_check.result == 'success' && needs.ci_changes.outputs.run_rust == 'true' }}
+    if: ${{ needs.ci_changes.outputs.run_rust == 'true' }}
     permissions:
       contents: read
     secrets:
@@ -154,19 +153,19 @@ jobs:
 
   ci_go:
     name: Go
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_go.yml
-    if: ${{ needs.ci_check.result == 'success' && needs.ci_changes.outputs.run_go == 'true' }}
+    if: ${{ needs.ci_changes.outputs.run_go == 'true' }}
     permissions:
       contents: read
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   ci_node:
     name: Node.js
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_node.yml
-    if: ${{ needs.ci_check.result == 'success' && needs.ci_changes.outputs.run_node == 'true' }}
+    if: ${{ needs.ci_changes.outputs.run_node == 'true' }}
     permissions:
       contents: read
     secrets:
@@ -179,17 +178,17 @@ jobs:
 
   ci_python:
     name: Python
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_python.yml
-    if: ${{ needs.ci_check.result == 'success' && ( needs.ci_changes.outputs.run_python == 'true' || needs.ci_changes.outputs.run_python_integration_langchain == 'true' ) }}
+    if: ${{ needs.ci_changes.outputs.run_python == 'true' || needs.ci_changes.outputs.run_python_integration_langchain == 'true' }}
     permissions:
       contents: read
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     with:
       ref_type: ${{ github.ref_type }}
       ref_name: ${{ github.ref_name }}
-      run_package: ${{ ( needs.ci_changes.outputs.run_python == 'true' || needs.ci_changes.outputs.run_python_integration_langchain == 'true' ) }}
+      run_package: ${{ needs.ci_changes.outputs.run_python_package == 'true' }}
       run_integration_langchain: ${{ needs.ci_changes.outputs.run_python_integration_langchain == 'true' }}
 
   ci_required:

.github/workflows/ci_check.yml

@@ -44,18 +44,27 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 10
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
           - platform: linux-x86_64
             runner: ubuntu-latest
+            shell: sh
             run_mock_tests: true
           - platform: linux-arm64
             runner: ubuntu-24.04-arm
+            shell: sh
             run_mock_tests: false
           - platform: macos-arm64
             runner: macos-15
+            shell: sh
             run_mock_tests: false
+          - platform: windows-x86_64
+            runner: windows-2022
+            shell: pwsh
+          - platform: windows-ARM64
+            runner: windows-11-arm
+            shell: pwsh
     permissions:
       contents: read
 
@@ -66,41 +75,22 @@ jobs:
           persist-credentials: false
 
       - name: Validate installer
+        if: ${{ matrix.shell == 'sh' }}
         run: |
           sh -n install.sh
           sh -n scripts/test-install.sh
           sh -n scripts/test-install-mocks.sh
 
       - name: Run live installer tests
+        if: ${{ matrix.shell == 'sh' }}
         run: sh scripts/test-install.sh
 
       - name: Run mock-only installer tests
-        if: ${{ matrix.run_mock_tests }}
+        if: ${{ matrix.shell == 'sh' && matrix.run_mock_tests }}
         run: sh scripts/test-install-mocks.sh
 
-  install-script-windows:
-    name: Install script (Windows ${{ matrix.architecture }})
-    if: ${{ inputs.run_installer }}
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - architecture: x86_64
-            runner: windows-2022
-          - architecture: ARM64
-            runner: windows-11-arm
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-
       - name: Validate PowerShell installer syntax
+        if: ${{ matrix.shell == 'pwsh' }}
         shell: pwsh
         run: |
           $scripts = @('install.ps1', 'scripts/test-install.ps1')
@@ -116,6 +106,7 @@ jobs:
           }
 
       - name: Run PowerShell installer tests
+        if: ${{ matrix.shell == 'pwsh' }}
         shell: pwsh
         run: ./scripts/test-install.ps1
 
@@ -164,7 +155,7 @@ jobs:
 
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          shared-key: nemo-relay-rust-${{ runner.os }}-${{ runner.arch }}-${{ steps.ci-config.outputs.rust_version }}
+          shared-key: nemo-relay-rust-linux-amd64-${{ steps.ci-config.outputs.rust_version }}
           workspaces: . -> target
           cache-all-crates: true
           cache-bin: false

.github/workflows/ci_go.yml

@@ -25,11 +25,10 @@ jobs:
     name: Test (${{ matrix.platform }})
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
-    continue-on-error: ${{ startsWith(matrix.platform, 'windows') }}
     permissions:
       contents: read
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
           - platform: linux-amd64
@@ -62,7 +61,7 @@ jobs:
 
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          shared-key: nemo-relay-rust-${{ runner.os }}-${{ runner.arch }}-${{ steps.ci-config.outputs.rust_version }}
+          shared-key: nemo-relay-rust-${{ matrix.platform }}-${{ steps.ci-config.outputs.rust_version }}
           workspaces: . -> target
           cache-all-crates: true
           cache-bin: false