ci: rebuild only what changed, and release on merge

[jackmarsh]

Why

Every PR and master push rebuilt all 22 versions on Linux and macOS, and the v* tag then rebuilt them all again before publishing. That's three full builds per release, each taking about an hour of macOS runners.

What

• Rebuild only what changed. Each (version, platform) build is cached under the hash of everything that decides its binaries: that version's binaries/<v>/, build_defs/, plugins/, .plzconfig, pleasew, the smoke test and this workflow.
  • A cache hit restores the tarballs and only re-runs the smoke test, which takes seconds and also catches a damaged entry.
  • A cache miss builds, smoke-tests, and saves only after the smoke test passes.
• Release on merge. A push to master whose RELEASE_VERSION has no release yet publishes the tarballs that run built, tagged at the merge commit itself. There's no hand-pushed tag and no tag rebuild, and the release is exactly what was built from the merged source.
• Safety: GitHub scopes caches by branch. A PR reads master's caches, but master never sees a PR's, so a PR (including one from a fork) can't put a binary into what master publishes. A version a PR changes is built once on the PR, to verify it, and once on master, to publish it. Unchanged versions aren't rebuilt at all.
• Release stays all-or-nothing: no release with a platform missing.

Test plan

• First run, with an empty cache, builds all 44 and saves them.
• A second push that changes no build input (the README update) restores all 44 from cache and builds nothing.
• Master after merge: RELEASE_VERSION is v0.0.6, which is already released, so no release is published.

🤖 Generated with Claude Code