[Wasabules]

CI took 12½ minutes, almost all of it waiting on the macOS job, and a few things in the workflows were held together by hand. This makes CI faster and the release workflow sturdier, without changing what either checks.

Faster

macOS runs the tests without -race. Measured on the last CI run:

	job	go test -race	internal/engine alone
macOS	12.4 min	535 s	471 s
Linux	5.5 min	180 s	110 s
Windows	5.0 min	145 s	72 s

The race detector instruments every memory access, and two things here make a great many: SQLite, which modernc translates from C into Go, and Argon2, whose x/crypto assembly is amd64 only. On the 3-core arm64 macOS runners that is four times Linux. Linux and Windows keep -race; the code it watches is shared, and macOS still runs every test.

The Wails CLI is cached in CI. Compiling it took 40 to 55 s in each build job.

Sturdier

• The Wails CLI version comes from go.mod (.github/actions/wails-cli), not from four pins in the workflows. Dependabot's wails/v2 bump now moves the CLI too; build(deps): bump github.com/wailsapp/wails/v2 from 2.17.0 to 2.17.1 #117 needed a hand-written commit for it, as build(deps): bump github.com/wailsapp/wails/v2 from 2.16.0 to 2.17.0 #88 did.
• The release restores no cache: not Go's module and build caches, not npm's, not the CLI. Caches are written by CI runs, which execute every pull request's dependencies, and what one left there would be compiled into a signed release. Everything is downloaded and checked against go.sum and package-lock.json instead, about a minute per build once per release.
• Every job has a timeout-minutes. The default is six hours; a test hung on a pipe or a lock would hold a macOS runner that long.
• CodeQL installs GTK/WebKit through linux-deps, the action with the mirror fallback that CI and the release already use; it was the last plain apt-get without a time limit.
• The release job runs on ubuntu-24.04 like every other job, not ubuntu-latest.
• actionlint checks the workflows in the quality job, shellcheck included. The release workflow only runs once a tag is pushed, so until now a mistake in it surfaced as a failed release.

Checked

• actionlint 1.7.12 clean, locally and in CI with the runner's shellcheck 0.9.0
• CI green on all three systems. CI now takes about 4½ minutes instead of 12½: the macOS job went from 12.4 min to 1.0 min (its go test from 535 s to 25 s, internal/engine from 471 s to 19 s; the 22 packages all ran), and Linux, at 4.4 min, is the longest job.
• The second run restored the Wails CLI from the cache on all three systems (wails-cli-{Windows-X64,Linux-X64,macOS-ARM64}-v2.17.1-go1.26.10): 1 to 3 s instead of 29 to 54 s.
• Merges cleanly with security: weekly audit, release checked as the updater will, tighter tokens #119, and actionlint is clean on the combination.

The release path (no caches, the CLI through the action) first runs at the next tag; actionlint checks it statically until then, and the release skill still verifies the published assets afterwards.