ci: eliminate duplicate Rust builds

[schickling-assistant]

Problem

The Linux Nix job regressed from 43 minutes at PR #389 to 57 minutes on recent main, with a recent PR reaching 88m55s. The tests themselves take seconds. The time was spent compiling the same Rust workspace in isolated buildRustPackage derivations, including Wasmtime/Cranelift up to five times.

Goal

Restore fast pull-request feedback without removing checks or adding build-system dependencies.

Decisions

• Consolidate checks by the inputs that actually require distinct compilation: feature set, codegen profile, and source bytes.
• Run additional test targets in the same derivation so Cargo reuses target/.
• Build all four WASIp2 guest components in one Cargo invocation.
• Keep four Linux shards. Three shards measured 29m10s; isolating the remaining independent integration compile produced the best measured result.
• Preserve the stable check-x86_64-linux status through a small aggregation job.

Rejected experiments:

• --cores 1: exceeded the 90-minute timeout.
• One deduplicated Linux job: 59m06s.
• Three shards: 29m10s.

Verification

Before:

Run	Linux wall time
latest baseline main (33981691773)	57m10s
recent tail, PR #461 (33981667111)	88m55s

After, rebased final commit:

Job	Duration
package	16m20s
providers	15m49s
wasm	12m37s
integration	9m48s
macOS	7m59s
workflow wall time	16m31s

Final run: https://github.com/compoundingtech/st2/actions/runs/34038038671

Additional checks:

• nix flake check --no-build --system x86_64-linux passed.
• Workflow shard coverage was compared against every exported Linux check: 12/12 assigned exactly once.
• git diff --check origin/main...HEAD passed.
• cargo fmt --all --check remains red on files already unformatted on main; this PR changes no Rust source.
• nix flake check --no-build --all-systems reaches the existing nixpkgs rejection of removed x86_64-darwin support. Linux and aarch64-darwin are green in the final CI run.

This reduces current Linux wall time by 71% versus latest main, and by 81% versus the recent tail.

Complexity

No dependencies or files were added. The flake removes duplicate derivation definitions and adds one small helper for extra Cargo test invocations. The workflow adds a four-row matrix and one stable aggregation job.

Concerns

Linux runner usage increases because four hosted jobs run in parallel. The tradeoff is intentional: compilation sharing reduces duplicated work first, while sharding reduces review latency. The provider chain now sets the practical floor.

Friction & bottlenecks

The failed one-core experiment demonstrated that the job is compilation-work-bound, not test-bound. The bakeoff also exposed an existing flag interaction where --lib selected the st2 library tests inside the provider invocation; the final commands scope each package explicitly and avoid that repeated suite.

Follow-ups

None required. A shared cross-job Cargo artifact cache could reduce runner-minutes further, but it would add global build complexity and is not justified by the 16m31s result.

References

• Baseline run: https://github.com/compoundingtech/st2/actions/runs/33981691773
• One-core experiment: https://github.com/compoundingtech/st2/actions/runs/34021165291
• Final run: https://github.com/compoundingtech/st2/actions/runs/34038038671

Posted on behalf of @schickling

field	value
agent_identity	unknown
session	unknown
agent_persona	unknown
agent_supervisor	unavailable
agent_tool	unknown
agent_tool_version	unknown
agent_runtime	unknown
tooling_profile	dotfiles@39a19af

[schickling-assistant]

Experiment complete: bounding each Nix derivation to one core made the Linux job exceed its 90-minute timeout (baseline latest main: 57m10s). Closing because this change is decisively worse; findings will inform a compilation-sharing or job-partitioning follow-up.

Posted on behalf of @schickling

field	value
agent_identity	unknown
session	unknown
agent_persona	unknown
agent_supervisor	unavailable
agent_tool	unknown
agent_tool_version	unknown
agent_runtime	unknown
tooling_profile	dotfiles@39a19af