* ci: optimize CI caching, concurrency, and Tauri security
Address multiple CI/CD efficiency and security gaps identified during
project optimization analysis. The changes reduce PR build times,
prevent wasteful concurrent runs, tighten the Tauri security boundary,
and eliminate unnecessary submodule fetches on non-macOS jobs.
CI workflow improvements:
- Add swatinem/rust-cache@v2 to both ci.yml jobs (android-check and
cross-platform), matching the caching already present in
release-tauri.yml. This converts PR Rust compilation from full
rebuilds to incremental builds, saving an estimated 60-80% of
compile time per run.
- Add concurrency groups to all three workflows. PR pushes cancel
superseded runs to free concurrency slots; tag pushes and manual
dispatches are isolated by run_id to avoid mutually canceling
release builds. Previously, rapid PR pushes triggered redundant
parallel CI runs with no cancellation.
- Unify Node version to 22 across release-tauri.yml and
android-apk.yml, which were previously pinned to 20. This ensures
consistent build environments across all workflows.
Submodule and security hardening:
- Conditionally fetch the vendor/qwen-asr submodule only on macOS
jobs across all three workflows. The submodule is compiled
exclusively by build.rs on macOS (build_qwen_asr_macos); Linux,
Windows, and Android builds never reference it. Removing the
unconditional recursive checkout eliminates a network fetch and
a submodule-availability failure point on every non-macOS job.
- Set withGlobalTauri to false in tauri.conf.json. The frontend
exclusively uses @tauri-apps/api imports and never references the
window.__TAURI__ global, so disabling it removes an unnecessary
XSS attack surface without functional impact.
Dependency hygiene:
- Move @types/dompurify from dependencies to devDependencies in
package.json. Type declaration packages are build-time only and
should not ship in the production bundle.
* fix(ci): address review findings
* fix(ci): isolate manual CI workflow runs
---------
Co-authored-by: Chris233 <h-chris233@outlook.com>
