fix(ci): predict release impact and align Nightly build contracts

.github/workflows/desktop-package.yml

@@ -277,6 +277,11 @@ jobs:
           shared-key: "package-v2-${{ matrix.platform.name }}"
           cache-bin: false
 
+      - name: Verify committed Cargo metadata
+        run: |
+          cargo metadata --locked --no-deps
+          cargo metadata --locked --no-deps --manifest-path BitFun-Installer/src-tauri/Cargo.toml
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -298,6 +303,11 @@ jobs:
         if: needs.prepare.outputs.release_channel == 'beta'
         run: node scripts/set-build-version.mjs --version "${{ needs.prepare.outputs.version }}"
 
+      - name: Verify build Cargo metadata
+        run: |
+          cargo metadata --locked --no-deps
+          cargo metadata --locked --no-deps --manifest-path BitFun-Installer/src-tauri/Cargo.toml
+
       - name: Verify release version metadata
         run: node scripts/verify-release-version-sync.mjs --version "${{ needs.prepare.outputs.version }}"
 

.github/workflows/linux-binaries.yml

@@ -15,6 +15,21 @@ on:
         description: "Stable prefix that isolates artifacts in the caller run."
         required: true
         type: string
+      artifact_retention_days:
+        description: "Retention for uploaded build artifacts."
+        required: false
+        default: 7
+        type: number
+      upload_artifacts:
+        description: "Whether to upload archives for a publishing caller."
+        required: false
+        default: true
+        type: boolean
+      cache_write:
+        description: "Allow a trusted non-PR caller to refresh build caches."
+        required: false
+        default: false
+        type: boolean
     secrets:
       release_signing_key:
         description: "Tauri/minisign private key, base64. Absent on forks: archives ship unsigned."
@@ -61,6 +76,13 @@ jobs:
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: "1.3.14"
+          no-cache: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version-file: package.json
+          package-manager-cache: false
 
       - name: Build plugin Host resources
         run: |
@@ -91,8 +113,13 @@ jobs:
       - name: Cache Rust build
         uses: swatinem/rust-cache@v2
         with:
-          shared-key: "linux-binaries-v1-${{ matrix.platform.name }}"
+          shared-key: "linux-binaries-v2-${{ github.base_ref || github.ref_name }}-${{ matrix.platform.name }}"
           cache-bin: false
+          save-if: ${{ inputs.cache_write && github.event_name != 'pull_request' }}
+          cache-on-failure: ${{ inputs.cache_write && github.event_name != 'pull_request' }}
+
+      - name: Verify committed Cargo metadata
+        run: cargo metadata --locked --no-deps
 
       - name: Patch build version
         shell: bash
@@ -106,12 +133,10 @@ jobs:
           # the same way, which also keeps the two asset sets on one version string.
           ASSET_VERSION="${RELEASE_VERSION%%+*}"
           echo "ASSET_VERSION=${ASSET_VERSION}" >>"$GITHUB_ENV"
-          sed -i \
-            "s/^version = \".*\" # x-release-please-version/version = \"${ASSET_VERSION}\" # x-release-please-version/" \
-            Cargo.toml
-          sed -i \
-            "s/^version = \".*\" # x-release-please-version/version = \"${ASSET_VERSION}\" # x-release-please-version/" \
-            src/apps/relay-server/Cargo.toml
+          node scripts/set-build-version.mjs --version "$ASSET_VERSION"
+
+      - name: Verify projected Cargo metadata
+        run: cargo metadata --locked --no-deps
 
       - name: Build CLI and Relay Server
         shell: bash
@@ -121,7 +146,7 @@ jobs:
           # checksum-only.
           BITFUN_RELEASE_PUBKEY: ${{ secrets.release_pubkey }}
         run: |
-          cargo build --release \
+          cargo build --locked --release \
             --target ${{ matrix.platform.target }} \
             -p bitfun-cli \
             -p bitfun-relay-server \
@@ -180,11 +205,12 @@ jobs:
             "$RELAY_ARCHIVE" "${RELAY_ARCHIVE}.sha256"
 
       - name: Upload Linux binary artifacts
+        if: ${{ inputs.upload_artifacts }}
         uses: actions/upload-artifact@v6
         with:
           name: bitfun-linux-${{ inputs.artifact_prefix }}-${{ matrix.platform.name }}
           if-no-files-found: error
-          retention-days: 7
+          retention-days: ${{ inputs.artifact_retention_days }}
           path: |
             ${{ steps.cli-stage.outputs.archive }}
             ${{ steps.cli-stage.outputs.checksum }}