Reuse the current native debug binary across parity profiles

.github/workflows/server-parity.yml

@@ -21,6 +21,7 @@ on:
       - scripts/ci/pull-images.sh
       - scripts/ci/patched-pip.sh
       - scripts/ci/sdk-adapter-cache-key.sh
+      - tests/Unit/NativeDebugArtifactTest.mjs
       - config/dw-contract.php
       - tests/Fixtures/ActivityMetadataProjection/**
       - tests/Fixtures/CodecRegression/**
@@ -156,6 +157,66 @@ jobs:
           MERGE_GROUP_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
         run: bash scripts/conformance/server-parity/changes.sh >> "$GITHUB_OUTPUT"
 
+  # Only the server executable is shared. Native test parts retain their
+  # Cargo builds, full test commands and the trusted-main dependency writer.
+  native-debug-build:
+    needs: changes
+    if: ${{ needs.changes.outputs.run == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    env:
+      RESOURCE_SCOPE: dw-native-debug-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
+    outputs:
+      artifact_name: ${{ steps.artifact.outputs.name }}
+      producer_attempt: ${{ steps.artifact.outputs.attempt }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - name: Pull the pinned compiler, retrying registry errors
+        run: bash scripts/ci/pull-images.sh "${NATIVE_RUST_IMAGE}"
+      - name: Validate native debug artifact and cleanup controls
+        run: node --test tests/Unit/NativeDebugArtifactTest.mjs
+      - name: Bind the artifact name to this producer attempt
+        id: artifact
+        run: |
+          printf 'name=native-debug-build-%s-%s\nattempt=%s\n' \
+            "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" "$GITHUB_RUN_ATTEMPT" >> "$GITHUB_OUTPUT"
+      - name: Restore native Cargo dependencies from trusted main
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            cargo-home/registry
+            cargo-home/git
+            rust-target
+          key: native-cargo-deps-v2-${{ runner.os }}-${{ runner.arch }}-${{ env.NATIVE_RUST_IMAGE }}-${{ hashFiles('rust/Cargo.lock', 'rust/Cargo.toml', 'rust/vendor/**', 'rust/.cargo/**') }}
+      - name: Fetch locked Rust dependencies
+        run: |
+          set -euo pipefail
+          mkdir -p cargo-home
+          docker run --rm --init --user="$(id -u):$(id -g)" --cpus=2 --memory=2g --memory-swap=2g \
+            -e CARGO_HOME=/cargo -e CARGO_NET_RETRY=10 \
+            -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -w /source/rust \
+            "${NATIVE_RUST_IMAGE}" cargo fetch --locked
+      - name: Build one run-bound native debug server
+        run: bash scripts/ci/native-debug-build.sh native-debug-build
+      - name: Verify the thin artifact before sharing
+        run: node scripts/ci/native-debug-artifact.mjs verify native-debug-build
+      - name: Share this attempt's server without compiler caches
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ steps.artifact.outputs.name }}
+          path: |
+            native-debug-build/server
+            native-debug-build/build.json
+            native-debug-build/SHA256SUMS
+          retention-days: 1
+          if-no-files-found: error
+      - name: Retire the owned debug build containers
+        if: always()
+        run: |
+          docker rm -f "$RESOURCE_SCOPE-clean" "$RESOURCE_SCOPE-build" >/dev/null 2>&1 || true
+
   published-sdk-adapters:
     needs: changes
     if: ${{ needs.changes.outputs.run == 'true' }}
@@ -380,7 +441,8 @@ jobs:
     # Named explicitly so the added native-tests-b combinations read like the
     # others instead of listing every matrix value.
     name: mysql-execution (${{ matrix.label }}, ${{ matrix.part }})
-    needs: published-sdk-adapters
+    needs: [published-sdk-adapters, native-debug-build]
+    if: ${{ !cancelled() && needs.published-sdk-adapters.result == 'success' }}
     runs-on: ubuntu-latest
     # Each part takes about 20 to 35 minutes; the fixture step runs every
     # later profile before failing, and scenario budgets stay fixed.
@@ -535,6 +597,34 @@ jobs:
             -e CARGO_HOME=/cargo -e CARGO_TARGET_DIR=/target \
             -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" -w /source/rust \
             "${NATIVE_RUST_IMAGE}" cargo clean --locked --offline --package durable-workflow-server
+      - name: Require a successful native debug producer
+        if: ${{ matrix.part != 'native-tests' && matrix.part != 'native-tests-b' }}
+        env:
+          NATIVE_BUILD_RESULT: ${{ needs.native-debug-build.result }}
+          NATIVE_BUILD_ARTIFACT: ${{ needs.native-debug-build.outputs.artifact_name }}
+          NATIVE_BUILD_RUN_ATTEMPT: ${{ needs.native-debug-build.outputs.producer_attempt }}
+        run: |
+          set -euo pipefail
+          test "$NATIVE_BUILD_RESULT" = success
+          [[ "$NATIVE_BUILD_RUN_ATTEMPT" =~ ^[1-9][0-9]{0,9}$ ]]
+          (( NATIVE_BUILD_RUN_ATTEMPT <= GITHUB_RUN_ATTEMPT ))
+          test "$NATIVE_BUILD_ARTIFACT" = "native-debug-build-$GITHUB_RUN_ID-$NATIVE_BUILD_RUN_ATTEMPT"
+      - name: Fetch this run's native debug server
+        if: ${{ matrix.part != 'native-tests' && matrix.part != 'native-tests-b' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: ${{ needs.native-debug-build.outputs.artifact_name }}
+          path: native-debug-build
+          digest-mismatch: error
+      - name: Verify and install this run's native debug server
+        if: ${{ matrix.part != 'native-tests' && matrix.part != 'native-tests-b' }}
+        env:
+          NATIVE_BUILD_RUN_ATTEMPT: ${{ needs.native-debug-build.outputs.producer_attempt }}
+        run: |
+          set -euo pipefail
+          mkdir -p parity-evidence rust-target/debug
+          node scripts/ci/native-debug-artifact.mjs verify native-debug-build > parity-evidence/native-debug-build.json
+          install -m 0755 native-debug-build/server rust-target/debug/durable-workflow-server
       - name: Bootstrap published PHP and native MySQL databases and run the native tests
         run: |
           set -euo pipefail
@@ -584,7 +674,7 @@ jobs:
             -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" \
             -v "$PWD/parity-evidence:/evidence" -w /source/rust --entrypoint bash \
             "${NATIVE_RUST_IMAGE}" -c \
-            'case "$DW_PARITY_PART" in native-tests) shard=1 suffix= ;; native-tests-b) shard=2 suffix=-b ;; *) shard= ;; esac; if [ "$DW_PARITY_PART" = native-tests ]; then cargo test --locked --offline --lib runtime::mysql:: -- --ignored --skip runtime::mysql::tests::bootstrap_child --nocapture --test-threads=2 > /evidence/mysql-tests.txt || exit 1; fi; if [ -n "$shard" ]; then cargo test --locked --offline --test execution -- --list --format terse | sed -n "s/: test\$//p" | LC_ALL=C sort | awk -v count="$DW_EXECUTION_SHARDS" -v shard="$shard" "(NR - 1) % count == shard - 1" > /evidence/execution-shard$suffix.txt && test -s /evidence/execution-shard$suffix.txt && cargo test --locked --offline --test execution -- --exact --nocapture --test-threads=2 $(cat /evidence/execution-shard$suffix.txt) > /evidence/mysql-execution-tests$suffix.txt || exit 1; fi; cargo build --locked --offline'
+            'case "$DW_PARITY_PART" in native-tests) shard=1 suffix= ;; native-tests-b) shard=2 suffix=-b ;; *) shard= ;; esac; if [ "$DW_PARITY_PART" = native-tests ]; then cargo test --locked --offline --lib runtime::mysql:: -- --ignored --skip runtime::mysql::tests::bootstrap_child --nocapture --test-threads=2 > /evidence/mysql-tests.txt || exit 1; fi; if [ -n "$shard" ]; then cargo test --locked --offline --test execution -- --list --format terse | sed -n "s/: test\$//p" | LC_ALL=C sort | awk -v count="$DW_EXECUTION_SHARDS" -v shard="$shard" "(NR - 1) % count == shard - 1" > /evidence/execution-shard$suffix.txt && test -s /evidence/execution-shard$suffix.txt && cargo test --locked --offline --test execution -- --exact --nocapture --test-threads=2 $(cat /evidence/execution-shard$suffix.txt) > /evidence/mysql-execution-tests$suffix.txt || exit 1; fi; case "$DW_PARITY_PART" in native-tests|native-tests-b) cargo build --locked --offline ;; *) test -x /target/debug/durable-workflow-server ;; esac'
           docker run --rm --user="$(id -u):$(id -g)" --network "$RESOURCE_SCOPE" \
             -e DW_RUST_EXPERIMENTAL=1 -e DB_CONNECTION=mysql -e DB_HOST=parity-mysql -e DB_DATABASE=native_ref \
             -e DB_USERNAME=root -e DB_PASSWORD=parity-disposable-password \
@@ -1115,7 +1205,8 @@ jobs:
           retention-days: 1
 
   postgres-storage:
-    needs: published-sdk-adapters
+    needs: [published-sdk-adapters, native-debug-build]
+    if: ${{ !cancelled() && needs.published-sdk-adapters.result == 'success' }}
     runs-on: ubuntu-latest
     # Each part takes about 20 to 35 minutes; the fixture step runs every
     # later profile before failing, and scenario budgets stay fixed.
@@ -1216,6 +1307,34 @@ jobs:
             -e CARGO_HOME=/cargo -e CARGO_TARGET_DIR=/target \
             -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" -w /source/rust \
             "${NATIVE_RUST_IMAGE}" cargo clean --locked --offline --package durable-workflow-server
+      - name: Require a successful native debug producer
+        if: ${{ matrix.part != 'native-tests' && matrix.part != 'native-tests-b' }}
+        env:
+          NATIVE_BUILD_RESULT: ${{ needs.native-debug-build.result }}
+          NATIVE_BUILD_ARTIFACT: ${{ needs.native-debug-build.outputs.artifact_name }}
+          NATIVE_BUILD_RUN_ATTEMPT: ${{ needs.native-debug-build.outputs.producer_attempt }}
+        run: |
+          set -euo pipefail
+          test "$NATIVE_BUILD_RESULT" = success
+          [[ "$NATIVE_BUILD_RUN_ATTEMPT" =~ ^[1-9][0-9]{0,9}$ ]]
+          (( NATIVE_BUILD_RUN_ATTEMPT <= GITHUB_RUN_ATTEMPT ))
+          test "$NATIVE_BUILD_ARTIFACT" = "native-debug-build-$GITHUB_RUN_ID-$NATIVE_BUILD_RUN_ATTEMPT"
+      - name: Fetch this run's native debug server
+        if: ${{ matrix.part != 'native-tests' && matrix.part != 'native-tests-b' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: ${{ needs.native-debug-build.outputs.artifact_name }}
+          path: native-debug-build
+          digest-mismatch: error
+      - name: Verify and install this run's native debug server
+        if: ${{ matrix.part != 'native-tests' && matrix.part != 'native-tests-b' }}
+        env:
+          NATIVE_BUILD_RUN_ATTEMPT: ${{ needs.native-debug-build.outputs.producer_attempt }}
+        run: |
+          set -euo pipefail
+          mkdir -p parity-evidence rust-target/debug
+          node scripts/ci/native-debug-artifact.mjs verify native-debug-build > parity-evidence/native-debug-build.json
+          install -m 0755 native-debug-build/server rust-target/debug/durable-workflow-server
       - name: Bootstrap published PHP and native PostgreSQL databases and run the native tests
         env:
           POSTGRES_IMAGE: ${{ matrix.image }}
@@ -1264,7 +1383,7 @@ jobs:
             -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" \
             -v "$PWD/parity-evidence:/evidence" -w /source/rust --entrypoint bash \
             "${NATIVE_RUST_IMAGE}" -c \
-            'if [ "$DW_PARITY_PART" = native-tests ]; then cargo test --locked --offline --lib runtime::postgres::tests::qualification_ -- --ignored --nocapture > /evidence/postgres-tests.txt && cargo test --locked --offline --test execution -- --nocapture > /evidence/postgres-execution-tests.txt; fi && cargo build --locked --offline'
+            'if [ "$DW_PARITY_PART" = native-tests ]; then cargo test --locked --offline --lib runtime::postgres::tests::qualification_ -- --ignored --nocapture > /evidence/postgres-tests.txt && cargo test --locked --offline --test execution -- --nocapture > /evidence/postgres-execution-tests.txt; fi && if [ "$DW_PARITY_PART" = native-tests ]; then cargo build --locked --offline; else test -x /target/debug/durable-workflow-server; fi'
           docker run --rm --user="$(id -u):$(id -g)" --network "$RESOURCE_SCOPE" \
             -e DW_RUST_EXPERIMENTAL=1 -e DB_CONNECTION=pgsql -e DB_HOST=parity-pg -e DB_DATABASE=native_ref \
             -e DB_USERNAME=parity -e DB_PASSWORD=parity-disposable-password \
@@ -1843,7 +1962,8 @@ jobs:
           retention-days: 1
 
   execution-and-codec:
-    needs: published-sdk-adapters
+    needs: [published-sdk-adapters, native-debug-build]
+    if: ${{ !cancelled() && needs.published-sdk-adapters.result == 'success' }}
     runs-on: ubuntu-latest
     # Each part takes about 20 to 35 minutes; the fixture step runs every
     # later profile before failing, and scenario budgets stay fixed.
@@ -1853,8 +1973,8 @@ jobs:
       # Six parts on separate runners: the native suites and codec, the
       # shared corpus, its profiles and restart cases, the published-SDK
       # direction profiles, the corrected marker cohort, and the other
-      # cohorts. Every part builds the same native server; no part depends on
-      # another.
+      # cohorts. Non-test parts use this run's verified debug server artifact;
+      # native-tests still builds and tests from source.
       matrix:
         part: [native-tests, corpus, restarts, cohorts, sdk-directions, corrected-markers]
     env:
@@ -1935,16 +2055,34 @@ jobs:
             -e CARGO_HOME=/cargo -e CARGO_TARGET_DIR=/target \
             -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" -w /source/rust \
             "${NATIVE_RUST_IMAGE}" cargo clean --locked --offline --package durable-workflow-server
-      - name: Build the native server
-        if: ${{ matrix.part != 'native-tests' }}
+      - name: Require a successful native debug producer
+        if: ${{ matrix.part != 'native-tests' && matrix.part != 'native-tests-b' }}
+        env:
+          NATIVE_BUILD_RESULT: ${{ needs.native-debug-build.result }}
+          NATIVE_BUILD_ARTIFACT: ${{ needs.native-debug-build.outputs.artifact_name }}
+          NATIVE_BUILD_RUN_ATTEMPT: ${{ needs.native-debug-build.outputs.producer_attempt }}
         run: |
           set -euo pipefail
-          mkdir -p cargo-home rust-target parity-evidence
-          docker run --rm --user="$(id -u):$(id -g)" --cpus=2 --memory=6g --memory-swap=6g \
-            -e CARGO_HOME=/cargo -e CARGO_TARGET_DIR=/target -e CARGO_BUILD_JOBS=2 \
-            -v "$PWD:/source:ro" -v "$PWD/cargo-home:/cargo" -v "$PWD/rust-target:/target" -w /source/rust \
-            "${NATIVE_RUST_IMAGE}" \
-            cargo build --locked --offline
+          test "$NATIVE_BUILD_RESULT" = success
+          [[ "$NATIVE_BUILD_RUN_ATTEMPT" =~ ^[1-9][0-9]{0,9}$ ]]
+          (( NATIVE_BUILD_RUN_ATTEMPT <= GITHUB_RUN_ATTEMPT ))
+          test "$NATIVE_BUILD_ARTIFACT" = "native-debug-build-$GITHUB_RUN_ID-$NATIVE_BUILD_RUN_ATTEMPT"
+      - name: Fetch this run's native debug server
+        if: ${{ matrix.part != 'native-tests' && matrix.part != 'native-tests-b' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: ${{ needs.native-debug-build.outputs.artifact_name }}
+          path: native-debug-build
+          digest-mismatch: error
+      - name: Verify and install this run's native debug server
+        if: ${{ matrix.part != 'native-tests' && matrix.part != 'native-tests-b' }}
+        env:
+          NATIVE_BUILD_RUN_ATTEMPT: ${{ needs.native-debug-build.outputs.producer_attempt }}
+        run: |
+          set -euo pipefail
+          mkdir -p parity-evidence rust-target/debug
+          node scripts/ci/native-debug-artifact.mjs verify native-debug-build > parity-evidence/native-debug-build.json
+          install -m 0755 native-debug-build/server rust-target/debug/durable-workflow-server
       - name: Execute official Rust codec and cross-decode with published PHP
         if: ${{ matrix.part == 'native-tests' }}
         run: |
@@ -2525,6 +2663,7 @@ jobs:
       - changes
       - published-sdk-adapters
       - codec-native-build
+      - native-debug-build
       - codec-deadline-health
       - mysql-execution
       - postgres-storage