fix(ci): run desktop shell checks in parallel with the build

The relocated desktop_shell job serialized up to 45 minutes ahead of the
120-minute build on every release and daily dry run, re-running cargo test
and test-release.js that build already runs ungated on all five matrix
entries against the same pinned revision. Keep the job, but gate only
publish and sync-oss on it; build needs prepare alone, so the shell lane
runs in parallel and nothing publishes unchecked.

Also: sdk-java.yml's cancel-in-progress expression named a trigger #14205
removed, so it was permanently false — make that literal. The desktop
qwen_code_ref input descriptions now say the ref must contain the desktop
crate, since a pre-desktop ref hard-fails the gate instead of passing
vacuously.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

.github/workflows/.size-baseline

@@ -22,8 +22,8 @@
 147136 ci.yml
 4193 codeql.yml
 9389 comment-attachment-guard.yml
-1634 desktop-packaging-check.yml
-44105 desktop-release.yml
+2090 desktop-packaging-check.yml
+44409 desktop-release.yml
 2038 docs-page-action.yml
 10005 dsw-swe-verified-release.yml
 40188 e2e.yml
@@ -49,7 +49,7 @@
 362377 qwen-triage.yml
 15171 release-chrome-extension.yml
 12872 release-managed-agent-reference.yml
-9701 release-sdk-java.yml
+11950 release-sdk-java.yml
 22345 release-sdk-python.yml
 20008 release-sdk.yml
 16655 release-vscode-companion.yml
@@ -58,7 +58,7 @@
 1079 scorecard-monthly.yml
 9751 sdk-java-contract-open-prs.yml
 9555 sdk-java-flyway-open-prs.yml
-69263 sdk-java.yml
+70375 sdk-java.yml
 3886 sdk-python.yml
 5595 security-checks.yml
 6777 serve-ab-publish.yml

.github/workflows/desktop-packaging-check.yml

@@ -18,7 +18,7 @@ on:
   workflow_dispatch:
     inputs:
       qwen_code_ref:
-        description: 'Qwen Code branch, tag, or commit to bundle.'
+        description: 'Qwen Code branch, tag, or commit to bundle; it must contain the desktop crate (packages/desktop/src-tauri), or the run fails.'
         required: true
         default: 'main'
         type: 'string'

.github/workflows/desktop-release.yml

@@ -12,7 +12,7 @@ on:
         required: true
         type: 'string'
       qwen_code_ref:
-        description: 'Qwen Code branch or commit to bundle, reachable from main. A release tag whose own commit is off main is refused here: dispatch checks the ref itself, while only the release event peels to its parent.'
+        description: 'Qwen Code branch or commit to bundle, reachable from main. Must contain the desktop crate (packages/desktop/src-tauri). A release tag whose own commit is off main is refused here: dispatch checks the ref itself, while only the release event peels to its parent.'
         required: true
         default: 'main'
         type: 'string'
@@ -291,10 +291,12 @@ jobs:
   build:
     name: 'Build ${{ matrix.name }}'
     if: "${{ needs.prepare.outputs.already_published != 'true' }}"
-    needs:
-      - 'prepare'
-      - 'desktop_shell'
-    runs-on: '${{ matrix.os }}'
+    needs: 'prepare'
+    # desktop_shell runs in parallel with build, not ahead of it: build
+    # itself compiles and tests the same pinned revision on every matrix
+    # entry, so serializing the shell lane would only add up to 45 minutes
+    # before the build. publish joins on both, so nothing is released
+    # unchecked.
     timeout-minutes: 120
     strategy:
       fail-fast: false

.github/workflows/sdk-java.yml

@@ -21,7 +21,7 @@ env:
 concurrency:
   group: 'sdk-java-${{ github.workflow }}-${{ github.ref }}'
   # Release callers and daily runs must not displace each other's validation.
-  cancel-in-progress: "${{ github.event_name == 'pull_request' }}"
+  cancel-in-progress: false
 
 jobs:
   test:

scripts/tests/desktop-isolation.test.js

@@ -203,7 +203,7 @@ describe('desktop_shell CI job — the crate path agrees with itself', () => {
     expect(desktopJob.defaults.run.shell).toBe('bash');
   });
 
-  it('gates build and publish on checks of the same release commit', () => {
+  it('gates publication on parallel checks of the same release commit', () => {
     expect(desktopJob.needs).toBe('prepare');
     expect(desktopJob.if).toBe(
       "${{ needs.prepare.outputs.already_published != 'true' }}",
@@ -213,10 +213,15 @@ describe('desktop_shell CI job — the crate path agrees with itself', () => {
       'windows-2022',
     ]);
     expect(desktopJob['continue-on-error']).toBeUndefined();
-    for (const name of ['build', 'publish']) {
-      expect(release.jobs[name].needs).toContain('desktop_shell');
-      expect(release.jobs[name].if).not.toMatch(/always\(|!cancelled\(/u);
-    }
+    // The shell lane runs in parallel with build; publish joins on both, so
+    // a failed shell check blocks publication without serializing ahead of
+    // the 120-minute build that runs the same tests on every matrix entry.
+    expect(release.jobs.build.needs).toBe('prepare');
+    expect(release.jobs.publish.needs).toEqual([
+      'prepare',
+      'desktop_shell',
+      'build',
+    ]);
     for (const name of ['desktop_shell', 'build', 'publish']) {
       const checkout = release.jobs[name].steps.find((step) =>
         step.uses?.startsWith('actions/checkout@'),

scripts/tests/desktop-oss-workflow.test.js

@@ -242,7 +242,7 @@ describe('Desktop OSS mirror workflow', () => {
     expect(prepare.outputs.already_published).toBe(
       '${{ steps.published.outputs.already_published }}',
     );
-    expect(releaseYaml.jobs.build.needs).toEqual(['prepare', 'desktop_shell']);
+    expect(releaseYaml.jobs.build.needs).toBe('prepare');
     expect(releaseYaml.jobs.build.if).toBe(
       "${{ needs.prepare.outputs.already_published != 'true' }}",
     );