Flake speedup

.github/workflows/pr-ci.yml

@@ -44,8 +44,38 @@ jobs:
         run: |
           time nix flake check --print-build-logs
 
-      - name: Build and smoke-test CLI
+      - name: Build and smoke-test native CLI
         run: |
-          time nix build .#default --out-link result --print-build-logs
+          time nix build .#sce --out-link result --print-build-logs
           ./result/bin/sce --help
           ./result/bin/sce version
+
+  release-validation:
+    name: Release validation (${{ matrix.os }})
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+
+      - name: Enable Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
+        with:
+          use-flakehub: false
+          use-gha-cache: true
+
+      - name: Build release package and audit portability
+        run: |
+          time nix build .#ci-checks --out-link result-ci-checks --print-build-logs

cli/build.rs

@@ -5,7 +5,6 @@ use std::{
     fs,
     io::{self, Write as IoWrite},
     path::{Path, PathBuf},
-    process::Command,
 };
 
 const TARGETS: &[TargetSpec] = &[
@@ -97,54 +96,20 @@ fn generate_migration_manifest() -> io::Result<()> {
 }
 
 fn emit_git_commit() {
+    // Commit embedding is release-only: the flake sets SCE_GIT_COMMIT solely on
+    // the release package derivation. Ordinary native builds, `cargo test`,
+    // Clippy, fmt, and other checks leave it unset so they stay cache-reusable
+    // across commits. When absent, the app falls back to "unknown" via
+    // `option_env!`. Deliberately no `git rev-parse` fallback and no
+    // `.git/HEAD` / `.git/packed-refs` rerun watches.
     println!("cargo:rerun-if-env-changed=SCE_GIT_COMMIT");
 
     if let Ok(commit) = env::var("SCE_GIT_COMMIT") {
         let commit = commit.trim();
         if !commit.is_empty() {
             println!("cargo:rustc-env=SCE_GIT_COMMIT={commit}");
-            return;
         }
     }
-
-    let manifest_dir = match env::var("CARGO_MANIFEST_DIR") {
-        Ok(value) => PathBuf::from(value),
-        Err(_) => return,
-    };
-
-    let repository_root = match manifest_dir.parent() {
-        Some(path) => path.to_path_buf(),
-        None => return,
-    };
-
-    let git_dir = repository_root.join(".git");
-    println!("cargo:rerun-if-changed={}", git_dir.join("HEAD").display());
-    println!(
-        "cargo:rerun-if-changed={}",
-        git_dir.join("packed-refs").display()
-    );
-
-    let output = Command::new("git")
-        .args(["rev-parse", "--short=12", "HEAD"])
-        .current_dir(&repository_root)
-        .output();
-
-    let Ok(output) = output else {
-        return;
-    };
-
-    if !output.status.success() {
-        return;
-    }
-
-    let Ok(commit) = String::from_utf8(output.stdout) else {
-        return;
-    };
-
-    let commit = commit.trim();
-    if !commit.is_empty() {
-        println!("cargo:rustc-env=SCE_GIT_COMMIT={commit}");
-    }
 }
 
 fn emit_repo_version() {
@@ -201,11 +166,14 @@ fn generate_embedded_asset_manifest() -> io::Result<()> {
             println!("cargo:rerun-if-changed={}", file.absolute_path.display());
             let bytes = fs::read(&file.absolute_path)?;
             let sha256 = compute_sha256(&bytes);
+            let include_path = format!("{}/{}", target.relative_root, file.relative_path);
             writeln!(
                 output,
-                "    EmbeddedAsset {{ relative_path: \"{}\", bytes: {}, sha256: {} }},",
+                "    EmbeddedAsset {{ relative_path: \"{}\", \
+                 bytes: include_bytes!(concat!(env!(\"CARGO_MANIFEST_DIR\"), \"/{}\")), \
+                 sha256: {} }},",
                 escape_for_rust_string(&file.relative_path),
-                format_byte_literal("&[", &bytes),
+                escape_for_rust_string(&include_path),
                 format_byte_literal("[", &sha256),
             )
             .expect("writing to String buffer should never fail");