ci: speed up the release loop (#18)

Skip the full build when only opening the version PR, skip Release on
unrelated main pushes, and skip CI/Nix on changeset-release/main so
auto-merge is not blocked for four minutes.

Stop the double publish (PAT merges already emit push; only keep the
pull_request fallback for github-actions[bot] merges) and serialize
Release on one concurrency group.

Leave checkout credentials unset so changesets/action pushes the version
branch with CHANGESETS_TOKEN instead of the job token. The job token
made those updates github-actions[bot] and parked CI in action_required.

Author: wangyuling93

.github/workflows/ci.yml

@@ -9,9 +9,14 @@ on:
 permissions:
   contents: read
 
+# Version PRs only bump package.json / CHANGELOG — the same commits already
+# passed CI on main. Skip the heavy jobs so auto-merge is not blocked for ~4
+# minutes (or stuck in action_required). The aggregate "CI" job still runs
+# and is the required check.
 jobs:
   build:
     runs-on: ubuntu-latest
+    if: github.head_ref != 'changeset-release/main'
 
     steps:
       - uses: actions/checkout@v4
@@ -30,6 +35,7 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    if: github.head_ref != 'changeset-release/main'
     strategy:
       fail-fast: false
       matrix:
@@ -52,6 +58,7 @@ jobs:
   # does not execute it; it needs its own job.
   test-pi-tui:
     runs-on: ubuntu-latest
+    if: github.head_ref != 'changeset-release/main'
 
     steps:
       - uses: actions/checkout@v4
@@ -71,6 +78,7 @@ jobs:
   # the extension selects through the rollback env var.
   test-vscode-legacy:
     runs-on: ubuntu-latest
+    if: github.head_ref != 'changeset-release/main'
 
     steps:
       - uses: actions/checkout@v4
@@ -110,6 +118,7 @@ jobs:
 
   lint:
     runs-on: ubuntu-latest
+    if: github.head_ref != 'changeset-release/main'
 
     steps:
       - uses: actions/checkout@v4
@@ -127,6 +136,7 @@ jobs:
 
   typecheck:
     runs-on: ubuntu-latest
+    if: github.head_ref != 'changeset-release/main'
 
     steps:
       - uses: actions/checkout@v4
@@ -157,6 +167,7 @@ jobs:
   # GitHub names the workflow-level check after the workflow, but the PR merge
   # machinery matches required contexts against job names here, so an explicit
   # job named CI is needed for the required check to be satisfiable.
+  # Skipped children (version PRs) are success — only failure/cancelled fail.
   CI:
     runs-on: ubuntu-latest
     needs: [build, test, test-pi-tui, lint, typecheck]

.github/workflows/nix-build.yml

@@ -16,6 +16,7 @@ jobs:
   check-workspace-sync:
     name: Check flake.nix workspace sync
     runs-on: ubuntu-latest
+    if: github.head_ref != 'changeset-release/main'
 
     steps:
       - name: Checkout
@@ -90,6 +91,7 @@ jobs:
     name: nix build .#kimi-code
     needs: check-workspace-sync
     runs-on: ubuntu-latest
+    if: github.head_ref != 'changeset-release/main'
 
     steps:
       - name: Checkout

.github/workflows/release.yml

@@ -4,14 +4,18 @@ on:
   push:
     branches:
       - main
-  # The version PR is merged via auto-merge, which does not emit a push event;
-  # fire the release from the merge's pull_request closed event instead.
+  # Fallback only: a GITHUB_TOKEN merge of the version PR does not emit push.
+  # PAT merges (the usual path) already fire the push event above — do not
+  # also handle those here or two publishes race.
   pull_request:
     types: [closed]
     branches:
       - main
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+# One publish at a time. Do not cancel an in-flight npm publish.
+concurrency:
+  group: release-${{ github.repository }}
+  cancel-in-progress: false
 
 jobs:
   release:
@@ -22,7 +26,8 @@ jobs:
       (github.event_name == 'push' ||
        (github.event_name == 'pull_request' &&
         github.event.pull_request.merged == true &&
-        github.event.pull_request.head.ref == 'changeset-release/main'))
+        github.event.pull_request.head.ref == 'changeset-release/main' &&
+        github.event.pull_request.merged_by.login == 'github-actions[bot]'))
     outputs:
       packages_published: ${{ steps.changesets.outputs.published }}
       kimi_native_release: ${{ steps.kimi-release.outputs.should_publish }}
@@ -39,41 +44,84 @@ jobs:
           # On pull_request (closed) events the checkout defaults to the PR
           # merge ref; always base the release on main's post-merge state.
           ref: main
+          # checkout's default extraheader uses the job GITHUB_TOKEN and beats
+          # changesets/action's .netrc PAT, so version-PR updates are pushed
+          # as github-actions[bot] and CI sits in action_required. Leave
+          # credentials unset; the action writes .netrc from CHANGESETS_TOKEN.
+          persist-credentials: false
+
+      - name: Detect release mode
+        id: mode
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          has_changesets=false
+          if find .changeset -maxdepth 1 -name '*.md' ! -name 'README.md' | grep -q .; then
+            has_changesets=true
+          fi
+
+          is_release_merge=false
+          subject=$(git log -1 --format=%s)
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            is_release_merge=true
+          elif [[ "$subject" == *"changeset-release/main"* ]]; then
+            is_release_merge=true
+          elif [ "$subject" = "ci: release packages" ]; then
+            is_release_merge=true
+          fi
+
+          if [ "$has_changesets" = true ]; then
+            echo "mode=version" >> "$GITHUB_OUTPUT"
+          elif [ "$is_release_merge" = true ]; then
+            echo "mode=publish" >> "$GITHUB_OUTPUT"
+          else
+            echo "mode=skip" >> "$GITHUB_OUTPUT"
+          fi
+          echo "mode has_changesets=$has_changesets is_release_merge=$is_release_merge subject=$subject"
 
       - name: Setup pnpm
+        if: steps.mode.outputs.mode != 'skip'
         uses: pnpm/action-setup@v6
 
       - name: Setup Node.js
+        if: steps.mode.outputs.mode != 'skip'
         uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           cache: "pnpm"
           registry-url: "https://registry.npmjs.org"
 
       - name: Upgrade npm for Trusted Publishing
+        if: steps.mode.outputs.mode == 'publish'
         run: npm install -g npm@11
 
       - name: Install dependencies
+        if: steps.mode.outputs.mode != 'skip'
         run: pnpm install --frozen-lockfile
 
       - name: Generate Kimi Code built-in catalog
+        if: steps.mode.outputs.mode == 'publish'
         shell: bash
         run: |
           CATALOG_FILE="$RUNNER_TEMP/kimi-code-built-in-catalog.json"
           node apps/kimi-code/scripts/update-catalog.mjs --out "$CATALOG_FILE"
           echo "KIMI_CODE_BUILT_IN_CATALOG_FILE=$CATALOG_FILE" >> "$GITHUB_ENV"
 
       - name: Build packages
+        if: steps.mode.outputs.mode == 'publish'
         run: pnpm build
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
+        if: steps.mode.outputs.mode != 'skip'
         uses: changesets/action@v1
         with:
           publish: pnpm changeset publish
           version: pnpm run version:release
           commit: "ci: release packages"
           title: "ci: release packages"
+          commitMode: git-cli
           # Use the maintainer's PAT so the version PR is authored by a real
           # account: PRs created by github-actions[bot] always require manual
           # workflow approval (the bot has no contribution history), which
@@ -93,7 +141,7 @@ jobs:
       # branch protection requiring status checks); changesets/action has no
       # such input of its own.
       - name: Enable auto-merge on the version PR
-        if: steps.changesets.outputs.pullRequestNumber != ''
+        if: steps.mode.outputs.mode != 'skip' && steps.changesets.outputs.pullRequestNumber != ''
         run: gh pr merge --repo "$GITHUB_REPOSITORY" --merge --auto "${{ steps.changesets.outputs.pullRequestNumber }}"
         env:
           # Auto-merge with the maintainer's PAT: merges performed with the