perf(ci): share one build, drop duplicate builds

.github/workflows/build-oci.yaml

@@ -15,16 +15,10 @@ name: Build OCI image tarballs
 on:
   workflow_call:
     inputs:
-      # JSON matrix-include list; callers can narrow to a subset of the
-      # default (e.g. ci builds only the qemu arches to avoid rebuilding
-      # what build-and-test already builds natively).
+      # JSON matrix-include list of {runner, arch, qemu?}; build.yaml owns it.
       matrix:
         type: string
-        default: >-
-          [{"runner": "ubuntu-24.04",     "arch": "amd64"},
-           {"runner": "ubuntu-24.04-arm", "arch": "arm64"},
-           {"runner": "ubuntu-24.04",     "arch": "s390x",   "qemu": true},
-           {"runner": "ubuntu-24.04",     "arch": "ppc64le", "qemu": true}]
+        required: true
 
 permissions:
   contents: read

.github/workflows/build.yaml

@@ -0,0 +1,35 @@
+name: Build
+
+# Reusable. Cross-compiles the go binaries, then builds + tests the native
+# images and builds the image tarballs side by side. Leaves binaries-<arch>
+# and images-<arch> artefacts for the caller. Shared by ci.yaml and
+# release.yaml so both build the same way.
+
+on:
+  workflow_call:
+    inputs:
+      # ci leaves out the native tarballs: build-and-test already builds and
+      # tests those images, and only release.yaml publishes the tarballs.
+      native-images:
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  binaries:
+    uses: ./.github/workflows/binaries.yaml
+
+  build-and-test:
+    needs: binaries
+    uses: ./.github/workflows/build-and-test.yaml
+
+  build-oci:
+    needs: binaries
+    uses: ./.github/workflows/build-oci.yaml
+    with:
+      matrix: >-
+        [${{ inputs.native-images && '{"runner": "ubuntu-24.04", "arch": "amd64"}, {"runner": "ubuntu-24.04-arm", "arch": "arm64"},' || '' }}
+         {"runner": "ubuntu-24.04", "arch": "s390x",   "qemu": true},
+         {"runner": "ubuntu-24.04", "arch": "ppc64le", "qemu": true}]

.github/workflows/ci.yaml

@@ -22,23 +22,13 @@ permissions:
   contents: read
 
 jobs:
-  binaries:
-    uses: ./.github/workflows/binaries.yaml
-
-  build-and-test:
-    needs: binaries
-    uses: ./.github/workflows/build-and-test.yaml
-
-  # Also build the qemu-arch images (s390x / ppc64le) so image breakage
-  # surfaces at PR time, not at release. Native arches are excluded --
-  # build-and-test already builds those.
-  build-oci:
-    needs: binaries
-    uses: ./.github/workflows/build-oci.yaml
+  # A PR merged on GitHub (committer web-flow) is followed by a release, which
+  # builds + tests the same tree, so skip the duplicate build on that push.
+  build:
+    if: github.event.head_commit.committer.username != 'web-flow'
+    uses: ./.github/workflows/build.yaml
     with:
-      matrix: >-
-        [{"runner": "ubuntu-24.04", "arch": "s390x",   "qemu": true},
-         {"runner": "ubuntu-24.04", "arch": "ppc64le", "qemu": true}]
+      native-images: false
 
   # Guard: inlined/*.yaml is generated from templates/ + scripts/ and also
   # committed (repo-tree consumers grab it directly). Regenerate and fail on
@@ -80,10 +70,11 @@ jobs:
 
   # The one check the main ruleset requires, so it doesn't have to list every
   # matrix job by name. always() makes a failed or cancelled dependency fail
-  # this job; a skipped required check would count as passing.
+  # this job; a skipped required check would count as passing. The only skip
+  # is build on a PR-merge push, so skipped dependencies pass.
   ci-ok:
     if: always()
-    needs: [binaries, build-and-test, build-oci, check-inlined, check-revision]
+    needs: [build, check-inlined, check-revision]
     runs-on: ubuntu-24.04
     steps:
       - name: Assert every job succeeded
@@ -92,7 +83,7 @@ jobs:
         run: |
           echo "results: $RESULTS"
           for r in $RESULTS; do
-            if [ "$r" != success ]; then
+            if [ "$r" != success ] && [ "$r" != skipped ]; then
               echo "::error::a job ended as $r"
               exit 1
             fi

.github/workflows/release.yaml

@@ -53,42 +53,20 @@ jobs:
           fi
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
 
-  binaries:
+  build:
     needs: revision
-    uses: ./.github/workflows/binaries.yaml
-
-  build-and-test:
-    needs: binaries
-    uses: ./.github/workflows/build-and-test.yaml
-
-  build-oci-native:
-    needs: [binaries, build-and-test]
-    uses: ./.github/workflows/build-oci.yaml
-    with:
-      matrix: >-
-        [{"runner": "ubuntu-24.04",     "arch": "amd64"},
-         {"runner": "ubuntu-24.04-arm", "arch": "arm64"}]
-
-  # qemu lanes publish untested, so they skip the build-and-test gate and
-  # overlap with it. Publishing still waits on the gated native lanes.
-  build-oci-qemu:
-    needs: binaries
-    uses: ./.github/workflows/build-oci.yaml
-    with:
-      matrix: >-
-        [{"runner": "ubuntu-24.04", "arch": "s390x",   "qemu": true},
-         {"runner": "ubuntu-24.04", "arch": "ppc64le", "qemu": true}]
+    uses: ./.github/workflows/build.yaml
 
   push-ghcr:
-    needs: [build-oci-native, build-oci-qemu]
+    needs: build
     uses: ./.github/workflows/push-ghcr.yaml
     permissions:
       contents: read
       packages: write
       id-token: write
 
   publish-release:
-    needs: [revision, binaries, build-oci-native, build-oci-qemu]
+    needs: [revision, build]
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions: