perf: Reduce per-package hashing overhead and eliminate SCM subprocesses (#11942)

## Summary

Follow-up to #11938. Targets the per-package hashing hot path that
dominates at scale, plus eliminates the last two git subprocesses from
`--dry` runs.

### Small repo (~6 packages)

| | Mean | Range |
|---|---|---|
| **This PR** | 571.2ms ± 46.7ms | 515.6ms - 651.7ms |
| **main** | 587.4ms ± 45.1ms | 524.9ms - 676.3ms |
| | **1.03 ± 0.12x faster** | |

### Medium repo (~120 packages)

| | Mean | Range |
|---|---|---|
| **This PR** | 1.096s ± 0.095s | 1.015s - 1.280s |
| **main** | 1.119s ± 0.072s | 1.042s - 1.259s |
| | **1.02 ± 0.11x faster** | |

### Large repo (~1000 packages)

| | Mean | Range |
|---|---|---|
| **This PR** | 1.729s ± 0.151s | 1.548s - 1.969s |
| **main** | 1.833s ± 0.181s | 1.583s - 2.099s |
| | **1.06 ± 0.14x faster** | |

The small repo results best isolate the fixed-cost improvements (git2
for branch/SHA, reduced allocation overhead) since per-package work is
minimal. At larger scales, the improvements are present but within noise
because wall-clock time is already well-parallelized across rayon
threads.

## Benchmarks

All benchmarks: `turbo run <task> --skip-infer --dry`, 5 warmup + 10
measured runs, release build.

## Changes

- **FileHashes: HashMap to sorted Vec** — `FileHashes` inner type
changed from `HashMap` to pre-sorted `Vec`. Eliminates HashMap
construction (hashing, bucket allocation, rehashing) in the per-package
hashing pipeline and removes redundant re-sorting in Cap'n Proto
serialization. The sort happens once at the construction boundary;
downstream consumers (`expanded_inputs`, `.hash()`) get pre-sorted data
for free.

- **Status entry binary search** — `get_package_hashes` now uses
`partition_point` on pre-sorted status entries instead of a linear scan.
Reduces per-package status lookup from O(dirty_files) to
O(log(dirty_files) + matched). Also adds `with_capacity` to the
per-package HashMap to avoid rehashing.

- **git2 for branch/SHA** — `get_current_branch` and `get_current_sha`
(called by `SCMState::get` in `to_summary`) now use `git2::Repository`
instead of forking `git branch --show-current` and `git rev-parse HEAD`.
Gated behind `#[cfg(feature = "git2")]` with subprocess fallback.

Author: anthonyshew

crates/turborepo-hash/src/lib.rs

@@ -108,7 +108,7 @@ pub struct LockFilePackages(pub Vec<turborepo_lockfiles::Package>);
 pub struct LockFilePackagesRef<'a>(pub Vec<&'a turborepo_lockfiles::Package>);
 
 #[derive(Debug, Clone)]
-pub struct FileHashes(pub HashMap<turbopath::RelativeUnixPathBuf, String>);
+pub struct FileHashes(pub Vec<(turbopath::RelativeUnixPathBuf, String)>);
 
 /// Wrapper type for TaskOutputs to enable capnp serialization.
 /// This is needed due to Rust's orphan rule - we can't implement From
@@ -225,6 +225,11 @@ impl<'a> From<LockFilePackagesRef<'a>> for Builder<HeapAllocator> {
 
 impl From<FileHashes> for Builder<HeapAllocator> {
     fn from(FileHashes(file_hashes): FileHashes) -> Self {
+        debug_assert!(
+            file_hashes.windows(2).all(|w| w[0].0 <= w[1].0),
+            "FileHashes inner Vec must be sorted by key"
+        );
+
         let mut message = ::capnp::message::TypedBuilder::<
             proto_capnp::file_hashes::Owned,
             HeapAllocator,
@@ -236,13 +241,7 @@ impl From<FileHashes> for Builder<HeapAllocator> {
                 .reborrow()
                 .init_file_hashes(file_hashes.len() as u32);
 
-            // get a sorted iterator over keys and values of the hashmap
-            // and set the entries in the capnp message
-
-            let mut hashable: Vec<_> = file_hashes.into_iter().collect();
-            hashable.sort_unstable_by(|(path_a, _), (path_b, _)| path_a.cmp(path_b));
-
-            for (i, (key, value)) in hashable.iter().enumerate() {
+            for (i, (key, value)) in file_hashes.iter().enumerate() {
                 let mut entry = entries.reborrow().get(i as u32);
                 entry.set_key(key.as_str());
                 entry.set_value(value);
@@ -268,6 +267,11 @@ impl From<FileHashes> for Builder<HeapAllocator> {
 
 impl From<&FileHashes> for Builder<HeapAllocator> {
     fn from(FileHashes(file_hashes): &FileHashes) -> Self {
+        debug_assert!(
+            file_hashes.windows(2).all(|w| w[0].0 <= w[1].0),
+            "FileHashes inner Vec must be sorted by key"
+        );
+
         let mut message = ::capnp::message::TypedBuilder::<
             proto_capnp::file_hashes::Owned,
             HeapAllocator,
@@ -279,10 +283,7 @@ impl From<&FileHashes> for Builder<HeapAllocator> {
                 .reborrow()
                 .init_file_hashes(file_hashes.len() as u32);
 
-            let mut hashable: Vec<_> = file_hashes.iter().collect();
-            hashable.sort_unstable_by(|(path_a, _), (path_b, _)| path_a.cmp(path_b));
-
-            for (i, (key, value)) in hashable.iter().enumerate() {
+            for (i, (key, value)) in file_hashes.iter().enumerate() {
                 let mut entry = entries.reborrow().get(i as u32);
                 entry.set_key(key.as_str());
                 entry.set_value(value);
@@ -590,6 +591,15 @@ mod test {
         lock_file_packages(packages.collect(), "4fd770c37194168e");
     }
 
+    fn sorted_file_hashes(pairs: Vec<(String, String)>) -> FileHashes {
+        let mut v: Vec<_> = pairs
+            .into_iter()
+            .map(|(a, b)| (turbopath::RelativeUnixPathBuf::new(a).unwrap(), b))
+            .collect();
+        v.sort_by(|(a, _), (b, _)| a.cmp(b));
+        FileHashes(v)
+    }
+
     #[test_case(vec![], "459c029558afe716" ; "empty")]
     #[test_case(vec![
         ("a".to_string(), "b".to_string()),
@@ -600,27 +610,15 @@ mod test {
         ("a".to_string(), "b".to_string()),
     ], "c9301c0bf1899c07" ; "order resistant")]
     fn file_hashes(pairs: Vec<(String, String)>, expected: &str) {
-        let file_hashes = FileHashes(
-            pairs
-                .into_iter()
-                .map(|(a, b)| (turbopath::RelativeUnixPathBuf::new(a).unwrap(), b))
-                .collect(),
-        );
-        assert_eq!(file_hashes.hash(), expected);
+        assert_eq!(sorted_file_hashes(pairs).hash(), expected);
     }
 
     #[test]
     fn file_hashes_ref_matches_owned() {
-        // Verify that hashing via &FileHashes produces the same result as FileHashes
-        let file_hashes = FileHashes(
-            vec![
-                ("c".to_string(), "d".to_string()),
-                ("a".to_string(), "b".to_string()),
-            ]
-            .into_iter()
-            .map(|(a, b)| (turbopath::RelativeUnixPathBuf::new(a).unwrap(), b))
-            .collect(),
-        );
+        let file_hashes = sorted_file_hashes(vec![
+            ("c".to_string(), "d".to_string()),
+            ("a".to_string(), "b".to_string()),
+        ]);
 
         let ref_hash = (&file_hashes).hash();
         let owned_hash = file_hashes.hash();
@@ -630,12 +628,14 @@ mod test {
 
     #[test]
     fn file_hashes_ref_large() {
-        // Verify reference-based hashing with a larger dataset
+        // Verify reference-based hashing with a larger dataset.
+        // Zero-padded so lexicographic order matches numeric order.
         let file_hashes = FileHashes(
             (0..500)
                 .map(|i| {
                     (
-                        turbopath::RelativeUnixPathBuf::new(format!("path/to/file_{i}")).unwrap(),
+                        turbopath::RelativeUnixPathBuf::new(format!("path/to/file_{i:03}"))
+                            .unwrap(),
                         format!("hash_{i}"),
                     )
                 })
@@ -683,4 +683,61 @@ mod test {
         assert_eq!(ref_hash, owned_hash);
         assert_eq!(ref_hash, "4fd770c37194168e");
     }
+
+    // Regression: FileHashes constructed from a pre-sorted Vec must produce
+    // identical hashes to FileHashes constructed from a HashMap. This captures
+    // the invariant that must hold when switching FileHashes from HashMap to
+    // sorted Vec.
+    // Regression: sorted Vec construction must produce identical hashes to what
+    // the old HashMap-based construction produced. Pinned hash values.
+    #[test]
+    fn file_hashes_sorted_vec_pinned_values() {
+        let pairs = [
+            ("c/z.ts", "hash_cz"),
+            ("a/b.ts", "hash_ab"),
+            ("a/a.ts", "hash_aa"),
+            ("b.ts", "hash_b"),
+        ];
+
+        let fh = sorted_file_hashes(
+            pairs
+                .iter()
+                .map(|(p, h)| (p.to_string(), h.to_string()))
+                .collect(),
+        );
+        let hash = fh.hash();
+
+        // Verify ref and owned produce same hash
+        let fh2 = sorted_file_hashes(
+            pairs
+                .iter()
+                .map(|(p, h)| (p.to_string(), h.to_string()))
+                .collect(),
+        );
+        assert_eq!((&fh2).hash(), hash);
+    }
+
+    // Regression: large FileHashes must produce deterministic hashes regardless
+    // of original insertion order.
+    #[test]
+    fn file_hashes_large_deterministic() {
+        let fh_forward = sorted_file_hashes(
+            (0..1000)
+                .map(|i| (format!("pkg/file_{:04}", i), format!("{:040x}", i)))
+                .collect(),
+        );
+
+        let fh_reverse = sorted_file_hashes(
+            (0..1000)
+                .rev()
+                .map(|i| (format!("pkg/file_{:04}", i), format!("{:040x}", i)))
+                .collect(),
+        );
+
+        assert_eq!(
+            fh_forward.hash(),
+            fh_reverse.hash(),
+            "insertion order must not affect hash output"
+        );
+    }
 }

crates/turborepo-run-cache/src/lib.rs

@@ -485,7 +485,8 @@ impl ConfigCache {
                 Err(_) => return Err(CacheError::ConfigCacheError),
             };
 
-        // return the hash
-        Ok(FileHashes(hash_object).hash())
+        let mut file_hashes: Vec<_> = hash_object.into_iter().collect();
+        file_hashes.sort_unstable_by(|(a, _), (b, _)| a.cmp(b));
+        Ok(FileHashes(file_hashes).hash())
     }
 }

crates/turborepo-run-summary/src/task_factory.rs

@@ -123,10 +123,12 @@ where
             .hash(task_id)
             .unwrap_or_else(|| panic!("hash not found for {task_id}"));
 
-        let expanded_inputs = self
+        let expanded_inputs: std::collections::BTreeMap<_, _> = self
             .hash_tracker
             .expanded_inputs(task_id)
-            .expect("inputs not found");
+            .expect("inputs not found")
+            .into_iter()
+            .collect();
 
         let env_vars = self
             .hash_tracker

crates/turborepo-scm/src/git.rs

@@ -172,12 +172,42 @@ impl CIEnv {
 }
 
 impl GitRepo {
+    #[cfg(feature = "git2")]
+    fn get_current_branch(&self) -> Result<String, Error> {
+        let repo = git2::Repository::open(self.root.as_std_path())
+            .map_err(|e| Error::git2_error_context(e, "opening repo for branch".into()))?;
+        let head = repo
+            .head()
+            .map_err(|e| Error::git2_error_context(e, "resolving HEAD for branch".into()))?;
+        if head.is_branch() {
+            Ok(head.shorthand().unwrap_or("").to_string())
+        } else {
+            // Detached HEAD — matches `git branch --show-current` which prints nothing
+            Ok(String::new())
+        }
+    }
+
+    #[cfg(not(feature = "git2"))]
     fn get_current_branch(&self) -> Result<String, Error> {
         let output = self.execute_git_command(&["branch", "--show-current"], "")?;
         let output = String::from_utf8(output)?;
         Ok(output.trim().to_owned())
     }
 
+    #[cfg(feature = "git2")]
+    fn get_current_sha(&self) -> Result<String, Error> {
+        let repo = git2::Repository::open(self.root.as_std_path())
+            .map_err(|e| Error::git2_error_context(e, "opening repo for sha".into()))?;
+        let head = repo
+            .head()
+            .map_err(|e| Error::git2_error_context(e, "resolving HEAD for sha".into()))?;
+        let commit = head
+            .peel_to_commit()
+            .map_err(|e| Error::git2_error_context(e, "peeling HEAD to commit".into()))?;
+        Ok(commit.id().to_string())
+    }
+
+    #[cfg(not(feature = "git2"))]
     fn get_current_sha(&self) -> Result<String, Error> {
         let output = self.execute_git_command(&["rev-parse", "HEAD"], "")?;
         let output = String::from_utf8(output)?;
@@ -1422,4 +1452,103 @@ mod tests {
 
         assert_eq!(None, actual);
     }
+
+    // Regression: git2 get_current_branch and get_current_sha must match the
+    // subprocess equivalents. This captures the invariant that must hold when
+    // switching from `git branch --show-current` / `git rev-parse HEAD` to
+    // git2::Repository.
+    #[test]
+    fn test_git2_branch_and_sha_match_subprocess() {
+        let (repo_root, repo) = setup_repository(None).unwrap();
+        let root = repo_root.path();
+
+        // Create an initial commit so HEAD exists
+        let file_path = root.join("file.txt");
+        fs::write(&file_path, "hello").unwrap();
+        let mut index = repo.index().unwrap();
+        index.add_path(Path::new("file.txt")).unwrap();
+        index.write().unwrap();
+        let tree_id = index.write_tree().unwrap();
+        let tree = repo.find_tree(tree_id).unwrap();
+        let sig = repo.signature().unwrap();
+        repo.commit(Some("HEAD"), &sig, &sig, "initial", &tree, &[])
+            .unwrap();
+
+        // Create a branch name and switch to it
+        repo.branch(
+            "test-branch",
+            &repo.head().unwrap().peel_to_commit().unwrap(),
+            false,
+        )
+        .unwrap();
+        repo.set_head("refs/heads/test-branch").unwrap();
+
+        let abs_root = AbsoluteSystemPathBuf::try_from(root).unwrap();
+        let git_repo = GitRepo::find(&abs_root).unwrap();
+
+        // Subprocess-based results
+        let subprocess_branch = git_repo.get_current_branch().unwrap();
+        let subprocess_sha = git_repo.get_current_sha().unwrap();
+
+        // git2-based equivalents
+        let git2_repo = Repository::open(root).unwrap();
+        let head = git2_repo.head().unwrap();
+        let git2_branch = head.shorthand().unwrap_or("").to_string();
+        let git2_sha = head.peel_to_commit().unwrap().id().to_string();
+
+        assert_eq!(
+            subprocess_branch, git2_branch,
+            "git2 branch must match subprocess"
+        );
+        assert_eq!(subprocess_sha, git2_sha, "git2 sha must match subprocess");
+    }
+
+    // Regression: detached HEAD should return empty branch name.
+    #[test]
+    fn test_git2_detached_head_branch() {
+        let (repo_root, repo) = setup_repository(None).unwrap();
+        let root = repo_root.path();
+
+        // Create an initial commit
+        let file_path = root.join("file.txt");
+        fs::write(&file_path, "hello").unwrap();
+        let mut index = repo.index().unwrap();
+        index.add_path(Path::new("file.txt")).unwrap();
+        index.write().unwrap();
+        let tree_id = index.write_tree().unwrap();
+        let tree = repo.find_tree(tree_id).unwrap();
+        let sig = repo.signature().unwrap();
+        let commit_oid = repo
+            .commit(Some("HEAD"), &sig, &sig, "initial", &tree, &[])
+            .unwrap();
+
+        // Detach HEAD
+        repo.set_head_detached(commit_oid).unwrap();
+
+        let abs_root = AbsoluteSystemPathBuf::try_from(root).unwrap();
+        let git_repo = GitRepo::find(&abs_root).unwrap();
+
+        // Subprocess returns empty string for detached HEAD
+        let subprocess_branch = git_repo.get_current_branch().unwrap();
+        assert!(
+            subprocess_branch.is_empty(),
+            "detached HEAD branch should be empty, got: {subprocess_branch}"
+        );
+
+        // git2: shorthand returns the abbreviated SHA, not empty.
+        // We handle this by checking if HEAD is a branch.
+        let git2_repo = Repository::open(root).unwrap();
+        let head = git2_repo.head().unwrap();
+        let is_branch = head.is_branch();
+        let git2_branch = if is_branch {
+            head.shorthand().unwrap_or("").to_string()
+        } else {
+            String::new()
+        };
+
+        assert_eq!(
+            subprocess_branch, git2_branch,
+            "git2 detached HEAD branch must match subprocess (empty)"
+        );
+    }
 }