ci: parallelize and strengthen package validation

.github/workflows/ci.yaml

@@ -125,12 +125,11 @@ jobs:
 
   ci_license_diff:
     name: License Diff
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_license_diff.yml
     if: >-
       ${{
         needs.prepare.outputs.is_pr == 'true'
-        && needs.ci_check.result == 'success'
         && needs.ci_changes.outputs.run_dependencies == 'true'
       }}
     permissions:
@@ -142,9 +141,9 @@ jobs:
 
   ci_rust:
     name: Rust
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_rust.yml
-    if: ${{ needs.ci_check.result == 'success' && needs.ci_changes.outputs.run_rust == 'true' }}
+    if: ${{ needs.ci_changes.outputs.run_rust == 'true' }}
     permissions:
       contents: read
     secrets:
@@ -154,19 +153,19 @@ jobs:
 
   ci_go:
     name: Go
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_go.yml
-    if: ${{ needs.ci_check.result == 'success' && needs.ci_changes.outputs.run_go == 'true' }}
+    if: ${{ needs.ci_changes.outputs.run_go == 'true' }}
     permissions:
       contents: read
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   ci_node:
     name: Node.js
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_node.yml
-    if: ${{ needs.ci_check.result == 'success' && needs.ci_changes.outputs.run_node == 'true' }}
+    if: ${{ needs.ci_changes.outputs.run_node == 'true' }}
     permissions:
       contents: read
     secrets:
@@ -179,17 +178,17 @@ jobs:
 
   ci_python:
     name: Python
-    needs: [prepare, ci_changes, ci_check]
+    needs: [prepare, ci_changes]
     uses: ./.github/workflows/ci_python.yml
-    if: ${{ needs.ci_check.result == 'success' && ( needs.ci_changes.outputs.run_python == 'true' || needs.ci_changes.outputs.run_python_integration_langchain == 'true' ) }}
+    if: ${{ needs.ci_changes.outputs.run_python == 'true' || needs.ci_changes.outputs.run_python_integration_langchain == 'true' }}
     permissions:
       contents: read
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     with:
       ref_type: ${{ github.ref_type }}
       ref_name: ${{ github.ref_name }}
-      run_package: ${{ ( needs.ci_changes.outputs.run_python == 'true' || needs.ci_changes.outputs.run_python_integration_langchain == 'true' ) }}
+      run_package: ${{ needs.ci_changes.outputs.run_python_package == 'true' }}
       run_integration_langchain: ${{ needs.ci_changes.outputs.run_python_integration_langchain == 'true' }}
 
   ci_required:

.github/workflows/ci_check.yml

@@ -44,18 +44,27 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 10
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
           - platform: linux-x86_64
             runner: ubuntu-latest
+            shell: sh
             run_mock_tests: true
           - platform: linux-arm64
             runner: ubuntu-24.04-arm
+            shell: sh
             run_mock_tests: false
           - platform: macos-arm64
             runner: macos-15
+            shell: sh
             run_mock_tests: false
+          - platform: windows-x86_64
+            runner: windows-2022
+            shell: pwsh
+          - platform: windows-ARM64
+            runner: windows-11-arm
+            shell: pwsh
     permissions:
       contents: read
 
@@ -66,41 +75,22 @@ jobs:
           persist-credentials: false
 
       - name: Validate installer
+        if: ${{ matrix.shell == 'sh' }}
         run: |
           sh -n install.sh
           sh -n scripts/test-install.sh
           sh -n scripts/test-install-mocks.sh
 
       - name: Run live installer tests
+        if: ${{ matrix.shell == 'sh' }}
         run: sh scripts/test-install.sh
 
       - name: Run mock-only installer tests
-        if: ${{ matrix.run_mock_tests }}
+        if: ${{ matrix.shell == 'sh' && matrix.run_mock_tests }}
         run: sh scripts/test-install-mocks.sh
 
-  install-script-windows:
-    name: Install script (Windows ${{ matrix.architecture }})
-    if: ${{ inputs.run_installer }}
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - architecture: x86_64
-            runner: windows-2022
-          - architecture: ARM64
-            runner: windows-11-arm
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-
       - name: Validate PowerShell installer syntax
+        if: ${{ matrix.shell == 'pwsh' }}
         shell: pwsh
         run: |
           $scripts = @('install.ps1', 'scripts/test-install.ps1')
@@ -116,6 +106,7 @@ jobs:
           }
 
       - name: Run PowerShell installer tests
+        if: ${{ matrix.shell == 'pwsh' }}
         shell: pwsh
         run: ./scripts/test-install.ps1
 
@@ -164,7 +155,7 @@ jobs:
 
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          shared-key: nemo-relay-rust-${{ runner.os }}-${{ runner.arch }}-${{ steps.ci-config.outputs.rust_version }}
+          shared-key: nemo-relay-rust-linux-amd64-${{ steps.ci-config.outputs.rust_version }}
           workspaces: . -> target
           cache-all-crates: true
           cache-bin: false

.github/workflows/ci_go.yml

@@ -25,11 +25,10 @@ jobs:
     name: Test (${{ matrix.platform }})
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
-    continue-on-error: ${{ startsWith(matrix.platform, 'windows') }}
     permissions:
       contents: read
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
           - platform: linux-amd64
@@ -62,7 +61,7 @@ jobs:
 
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          shared-key: nemo-relay-rust-${{ runner.os }}-${{ runner.arch }}-${{ steps.ci-config.outputs.rust_version }}
+          shared-key: nemo-relay-rust-${{ matrix.platform }}-${{ steps.ci-config.outputs.rust_version }}
           workspaces: . -> target
           cache-all-crates: true
           cache-bin: false