From 908a6bd15808ce113d991d43ddfd3b9d4f47e96e Mon Sep 17 00:00:00 2001
From: MK <fengmk2@gmail.com>
Date: Fri, 9 Oct 2026 14:44:46 +0800
Subject: [PATCH 1/5] perf(ci): parallelize independent workflow steps

---
 .github/workflows/ci.yml                      | 376 +++++++++---------
 .github/workflows/e2e-test.yml                |  76 ++--
 .github/workflows/prepare_release.yml         |   2 +
 .github/workflows/renovate-lockfiles.yml      |   1 +
 .github/workflows/reusable-release-build.yml  | 172 ++++----
 .github/workflows/security.yml                |   2 +-
 .../workflows/update-node-release-keys.yml    |   2 +
 .../workflows/update-trusted-stack-stats.yml  |   2 +
 .github/workflows/upgrade-deps.yml            |   2 +
 9 files changed, 332 insertions(+), 303 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1eb4df3608..984f3e1bd0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,14 +69,15 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-        with:
-          # Shares the Cargo cache with the Linux CLI test build job, which
-          # builds the same target. Only that job saves it.
-          save-cache: false
-          cache-key: cli-snapshot-test-x86_64-unknown-linux-gnu
+      - parallel:
+          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+            with:
+              # Shares the Cargo cache with the Linux CLI test build job, which
+              # builds the same target. Only that job saves it.
+              save-cache: false
+              cache-key: cli-snapshot-test-x86_64-unknown-linux-gnu
 
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
       # Format-check with the oxfmt of this commit instead of the released one.
       # A release carries the oxfmt it shipped with, which trails the catalog
@@ -201,24 +202,25 @@ jobs:
           cargo nextest archive $(for d in crates/*/; do n=$(basename $d); [ "$n" = "vp_cli_snapshots" ] || [ "$n" = "vp_trampoline" ] || echo -n "-p $n "; done) -p vite-plus-cli \
             --target x86_64-pc-windows-msvc --archive-file windows-tests.tar.zst
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: windows-test-archive
-          path: windows-tests.tar.zst
-          retention-days: 7
-
-      # Separate archive for the PTY snapshot suite (excluded from the
-      # unit-test archive above): its suite needs vp, node, and a built
-      # packages/cli/dist at runtime, which only cli-snapshot-test-windows
-      # provides. The archive carries the cli_snapshots test binary plus the
-      # vpt helper; nextest rewrites CARGO_MANIFEST_DIR/CARGO_BIN_EXE_vpt at
-      # run time so the relocated binaries find fixtures and helpers.
-      - name: Build snapshot test archive
-        run: |
-          eval "$(cargo xwin env --target x86_64-pc-windows-msvc | grep '^export ')"
-          unset RUSTFLAGS
-          cargo nextest archive -p vp_cli_snapshots \
-            --target x86_64-pc-windows-msvc --archive-file windows-snapshot-tests.tar.zst
+      - parallel:
+          - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            with:
+              name: windows-test-archive
+              path: windows-tests.tar.zst
+              retention-days: 7
+
+          # Separate archive for the PTY snapshot suite (excluded from the
+          # unit-test archive above): its suite needs vp, node, and a built
+          # packages/cli/dist at runtime, which only cli-snapshot-test-windows
+          # provides. The archive carries the cli_snapshots test binary plus the
+          # vpt helper; nextest rewrites CARGO_MANIFEST_DIR/CARGO_BIN_EXE_vpt at
+          # run time so the relocated binaries find fixtures and helpers.
+          - name: Build snapshot test archive
+            run: |
+              eval "$(cargo xwin env --target x86_64-pc-windows-msvc | grep '^export ')"
+              unset RUSTFLAGS
+              cargo nextest archive -p vp_cli_snapshots \
+                --target x86_64-pc-windows-msvc --archive-file windows-snapshot-tests.tar.zst
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -234,13 +236,14 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: windows-test-archive
+      - parallel:
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: windows-test-archive
 
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        with:
-          tool: cargo-nextest
+          - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+            with:
+              tool: cargo-nextest
 
       # `cargo-nextest` is invoked directly so the job never depends on the
       # runner's Rust toolchain.
@@ -332,18 +335,19 @@ jobs:
           tools: just,cargo-shear
           components: clippy rust-docs rustfmt
 
-      - run: |
-          cargo shear
-          cargo fmt --check
-          cargo fmt --manifest-path crates/vp_trampoline/Cargo.toml --check
-          just lint
-          # RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --document-private-items
+      - parallel:
+          - run: |
+              cargo shear
+              cargo fmt --check
+              cargo fmt --manifest-path crates/vp_trampoline/Cargo.toml --check
+              just lint
+              # RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --document-private-items
 
-      - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
-        with:
-          files: .
+          - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+            with:
+              files: .
 
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
       - name: Install docs dependencies
         run: pnpm -C docs install --frozen-lockfile
@@ -401,32 +405,33 @@ jobs:
 
       - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-      - name: Install docs dependencies
-        run: pnpm -C docs install --frozen-lockfile
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: rolldown-binaries
-          path: ./rolldown/packages/rolldown/src
-          merge-multiple: true
-
-      # Prebuilt by build-windows-cli (Linux + cargo-xwin); the artifact
-      # paths are workspace-relative, so this places the binding into
-      # packages/cli/binding/ and the CLI binaries into
-      # target/x86_64-pc-windows-msvc/release/ where
-      # `tool install-global-cli` finds them.
-      - name: Download prebuilt Windows binaries
-        if: runner.os == 'Windows'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: windows-cli-binaries
-
-      - name: Download prebuilt CLI test binaries
-        if: runner.os != 'Windows'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: cli-test-binaries-${{ matrix.target }}
-          path: ${{ runner.temp }}
+      - parallel:
+          - name: Install docs dependencies
+            run: pnpm -C docs install --frozen-lockfile
+
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: rolldown-binaries
+              path: ./rolldown/packages/rolldown/src
+              merge-multiple: true
+
+          # Prebuilt by build-windows-cli (Linux + cargo-xwin); the artifact
+          # paths are workspace-relative, so this places the binding into
+          # packages/cli/binding/ and the CLI binaries into
+          # target/x86_64-pc-windows-msvc/release/ where
+          # `tool install-global-cli` finds them.
+          - name: Download prebuilt Windows binaries
+            if: runner.os == 'Windows'
+            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: windows-cli-binaries
+
+          - name: Download prebuilt CLI test binaries
+            if: runner.os != 'Windows'
+            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: cli-test-binaries-${{ matrix.target }}
+              path: ${{ runner.temp }}
 
       - name: Extract CLI test binaries
         if: runner.os != 'Windows'
@@ -951,18 +956,19 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-        with:
-          save-cache: ${{ github.ref_name == 'main' }}
-          cache-key: cli-snapshot-test-${{ matrix.target }}
+      - parallel:
+          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+            with:
+              save-cache: ${{ github.ref_name == 'main' }}
+              cache-key: cli-snapshot-test-${{ matrix.target }}
 
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: rolldown-binaries
-          path: ./rolldown/packages/rolldown/src
-          merge-multiple: true
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: rolldown-binaries
+              path: ./rolldown/packages/rolldown/src
+              merge-multiple: true
 
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
@@ -1038,19 +1044,20 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - parallel:
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: rolldown-binaries
-          path: ./rolldown/packages/rolldown/src
-          merge-multiple: true
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: rolldown-binaries
+              path: ./rolldown/packages/rolldown/src
+              merge-multiple: true
 
-      - name: Download prebuilt CLI test binaries
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: cli-test-binaries-${{ matrix.target }}
-          path: ${{ runner.temp }}
+          - name: Download prebuilt CLI test binaries
+            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: cli-test-binaries-${{ matrix.target }}
+              path: ${{ runner.temp }}
 
       - name: Extract CLI test binaries
         run: tar -xzf "$RUNNER_TEMP/cli-test-binaries.tar.gz"
@@ -1064,6 +1071,7 @@ jobs:
       - name: Install Global CLI vp
         run: pnpm bootstrap-cli:ci
 
+      # Fish and Zsh can both use apt or Homebrew; keep their installs sequential.
       - name: Ensure Fish is installed
         run: |
           if ! command -v fish >/dev/null 2>&1; then
@@ -1088,25 +1096,26 @@ jobs:
           fi
           zsh --version
 
-      # https://github.com/marketplace/actions/setup-nu
-      - name: Install Nushell
-        uses: hustcer/setup-nu@ccd5bb5426b05a32009c2ba967946231f3919c97 # v3.25
-        with:
-          version: '*'
-
-      # Provision the managed runtime once into the real home so cases can
-      # seed from it (seed-runtime) instead of each downloading ~50MB.
-      # Best-effort: without a seed, cases that need the runtime download it
-      # themselves.
-      - name: Prewarm managed runtime
-        run: |
-          "$HOME/.vite-plus/bin/vp" node --version \
-            || echo "prewarm failed; cases will download the runtime on demand"
-
-      - name: Install Playwright Chromium
-        run: pnpm exec playwright install chromium
-        env:
-          PLAYWRIGHT_BROWSERS_PATH: '0'
+      - parallel:
+          # https://github.com/marketplace/actions/setup-nu
+          - name: Install Nushell
+            uses: hustcer/setup-nu@ccd5bb5426b05a32009c2ba967946231f3919c97 # v3.25
+            with:
+              version: '*'
+
+          # Provision the managed runtime once into the real home so cases can
+          # seed from it (seed-runtime) instead of each downloading ~50MB.
+          # Best-effort: without a seed, cases that need the runtime download it
+          # themselves.
+          - name: Prewarm managed runtime
+            run: |
+              "$HOME/.vite-plus/bin/vp" node --version \
+                || echo "prewarm failed; cases will download the runtime on demand"
+
+          - name: Install Playwright Chromium
+            run: pnpm exec playwright install chromium
+            env:
+              PLAYWRIGHT_BROWSERS_PATH: '0'
 
       - name: Run PTY snapshot tests
         run: |
@@ -1181,19 +1190,20 @@ jobs:
         shell: bash
         run: mkdir -p "$TEMP" "$TMP"
 
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - parallel:
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: rolldown-binaries
-          path: ./rolldown/packages/rolldown/src
-          merge-multiple: true
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: rolldown-binaries
+              path: ./rolldown/packages/rolldown/src
+              merge-multiple: true
 
-      # See the cli-e2e-test job for details on the prebuilt binaries.
-      - name: Download prebuilt Windows binaries
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: windows-cli-binaries
+          # See the cli-e2e-test job for details on the prebuilt binaries.
+          - name: Download prebuilt Windows binaries
+            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: windows-cli-binaries
 
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
@@ -1205,29 +1215,30 @@ jobs:
         shell: bash
         run: pnpm bootstrap-cli:ci
 
-      # Provision the managed runtime once into the real home so cases can
-      # seed from it (seed-runtime) instead of each downloading ~50MB.
-      # Best-effort: without a seed, cases that need the runtime download it
-      # themselves.
-      - name: Prewarm managed runtime
-        shell: bash
-        run: |
-          "$USERPROFILE/.vite-plus/bin/vp.exe" node --version \
-            || echo "prewarm failed; cases will download the runtime on demand"
-
-      - name: Install Playwright Chromium
-        shell: bash
-        run: pnpm exec playwright install chromium
-        env:
-          PLAYWRIGHT_BROWSERS_PATH: '0'
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: windows-snapshot-test-archive
-
-      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        with:
-          tool: cargo-nextest
+      - parallel:
+          # Provision the managed runtime once into the real home so cases can
+          # seed from it (seed-runtime) instead of each downloading ~50MB.
+          # Best-effort: without a seed, cases that need the runtime download it
+          # themselves.
+          - name: Prewarm managed runtime
+            shell: bash
+            run: |
+              "$USERPROFILE/.vite-plus/bin/vp.exe" node --version \
+                || echo "prewarm failed; cases will download the runtime on demand"
+
+          - name: Install Playwright Chromium
+            shell: bash
+            run: pnpm exec playwright install chromium
+            env:
+              PLAYWRIGHT_BROWSERS_PATH: '0'
+
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: windows-snapshot-test-archive
+
+          - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+            with:
+              tool: cargo-nextest
 
       # Keep fixtures outside runner.temp: setup-node writes an .npmrc there,
       # which Yarn Classic discovers when walking parent directories.
@@ -1315,18 +1326,19 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-        with:
-          save-cache: ${{ github.ref_name == 'main' }}
-          cache-key: cli-e2e-test-musl
+      - parallel:
+          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+            with:
+              save-cache: ${{ github.ref_name == 'main' }}
+              cache-key: cli-e2e-test-musl
 
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: rolldown-binaries
-          path: ./rolldown/packages/rolldown/src
-          merge-multiple: true
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: rolldown-binaries
+              path: ./rolldown/packages/rolldown/src
+              merge-multiple: true
 
       # Cross-compile for musl on the glibc host
       - name: Build with upstream (musl)
@@ -1453,18 +1465,19 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-        with:
-          save-cache: ${{ github.ref_name == 'main' }}
-          cache-key: install-e2e-test
+      - parallel:
+          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+            with:
+              save-cache: ${{ github.ref_name == 'main' }}
+              cache-key: install-e2e-test
 
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: rolldown-binaries
-          path: ./rolldown/packages/rolldown/src
-          merge-multiple: true
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: rolldown-binaries
+              path: ./rolldown/packages/rolldown/src
+              merge-multiple: true
 
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
@@ -1568,26 +1581,27 @@ jobs:
 
       # Windows runs against the prebuilt binaries from build-windows-cli,
       # so it needs no Rust toolchain or dev drive here.
-      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-        if: runner.os != 'Windows'
-        with:
-          save-cache: ${{ github.ref_name == 'main' }}
-          cache-key: install-e2e-test-sfw-${{ matrix.os }}
-
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: rolldown-binaries
-          path: ./rolldown/packages/rolldown/src
-          merge-multiple: true
-
-      # See the cli-e2e-test job for details on the prebuilt binaries.
-      - name: Download prebuilt Windows binaries
-        if: runner.os == 'Windows'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: windows-cli-binaries
+      - parallel:
+          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+            if: runner.os != 'Windows'
+            with:
+              save-cache: ${{ github.ref_name == 'main' }}
+              cache-key: install-e2e-test-sfw-${{ matrix.os }}
+
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: rolldown-binaries
+              path: ./rolldown/packages/rolldown/src
+              merge-multiple: true
+
+          # See the cli-e2e-test job for details on the prebuilt binaries.
+          - name: Download prebuilt Windows binaries
+            if: runner.os == 'Windows'
+            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: windows-cli-binaries
 
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 67fecaa432..0e3ff397d3 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -116,27 +116,28 @@ jobs:
 
       # Windows builds against the prebuilt binaries from build-windows-cli, so
       # it needs no Rust toolchain here.
-      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-        if: ${{ !contains(matrix.target, 'windows') }}
-        with:
-          save-cache: ${{ github.ref_name == 'main' }}
-          cache-key: e2e-build-${{ matrix.os }}
-
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: rolldown-binaries
-          path: ./rolldown/packages/rolldown/src
-          merge-multiple: true
-
-      # Prebuilt by build-windows-cli (Linux + cargo-xwin); placed where
-      # build-upstream's skip-native pass and the pack step expect them.
-      - name: Download prebuilt Windows binaries
-        if: contains(matrix.target, 'windows')
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: windows-cli-binaries
+      - parallel:
+          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+            if: ${{ !contains(matrix.target, 'windows') }}
+            with:
+              save-cache: ${{ github.ref_name == 'main' }}
+              cache-key: e2e-build-${{ matrix.os }}
+
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+
+          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: rolldown-binaries
+              path: ./rolldown/packages/rolldown/src
+              merge-multiple: true
+
+          # Prebuilt by build-windows-cli (Linux + cargo-xwin); placed where
+          # build-upstream's skip-native pass and the pack step expect them.
+          - name: Download prebuilt Windows binaries
+            if: contains(matrix.target, 'windows')
+            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: windows-cli-binaries
 
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
@@ -513,22 +514,23 @@ jobs:
         shell: powershell
         run: Set-MpPreference -DisableRealtimeMonitoring $true
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ matrix.project.node-version }}
-          package-manager-cache: false
-
-      - name: Download vite-plus packages
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: vite-plus-packages-${{ matrix.os }}
-          path: tmp/tgz
-
-      - name: Install Codiff native-keymap dependencies
-        if: matrix.project.name == 'codiff'
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes libx11-dev libxkbfile-dev
+      - parallel:
+          - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+            with:
+              node-version: ${{ matrix.project.node-version }}
+              package-manager-cache: false
+
+          - name: Download vite-plus packages
+            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+            with:
+              name: vite-plus-packages-${{ matrix.os }}
+              path: tmp/tgz
+
+          - name: Install Codiff native-keymap dependencies
+            if: matrix.project.name == 'codiff'
+            run: |
+              sudo apt-get update
+              sudo apt-get install --yes libx11-dev libxkbfile-dev
 
       - name: Install vp CLI
         shell: bash
diff --git a/.github/workflows/prepare_release.yml b/.github/workflows/prepare_release.yml
index 3a6215c4b4..967d7aaca6 100644
--- a/.github/workflows/prepare_release.yml
+++ b/.github/workflows/prepare_release.yml
@@ -66,6 +66,8 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
diff --git a/.github/workflows/renovate-lockfiles.yml b/.github/workflows/renovate-lockfiles.yml
index 668d76fc93..17a661a7ee 100644
--- a/.github/workflows/renovate-lockfiles.yml
+++ b/.github/workflows/renovate-lockfiles.yml
@@ -75,6 +75,7 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
 
       - name: Commit and push lockfiles
         if: steps.diff.outputs.changed == 'true'
diff --git a/.github/workflows/reusable-release-build.yml b/.github/workflows/reusable-release-build.yml
index 1b6520acfb..7f4205ccf2 100644
--- a/.github/workflows/reusable-release-build.yml
+++ b/.github/workflows/reusable-release-build.yml
@@ -59,10 +59,11 @@ jobs:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: ${{ inputs.cache-key }}
 
-      - name: Rustup Adds Target
-        run: rustup target add ${{ matrix.settings.target }}
+      - parallel:
+          - name: Rustup Adds Target
+            run: rustup target add ${{ matrix.settings.target }}
 
-      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
       - name: Set build version
         shell: bash
@@ -117,35 +118,36 @@ jobs:
         with:
           target: ${{ matrix.settings.target }}
 
-      - name: Upload Vite+ native artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: vite-plus-native-${{ matrix.settings.target }}
-          path: ./packages/cli/binding/*.node
-          if-no-files-found: error
+      - parallel:
+          - name: Upload Vite+ native artifact
+            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            with:
+              name: vite-plus-native-${{ matrix.settings.target }}
+              path: ./packages/cli/binding/*.node
+              if-no-files-found: error
 
-      - name: Upload Rust CLI binary artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: vp-global-cli-${{ matrix.settings.target }}
-          path: |
-            ./target/${{ matrix.settings.target }}/release/vp
-            ./target/${{ matrix.settings.target }}/release/vp.exe
-            ./target/${{ matrix.settings.target }}/release/vp-shim.exe
-          if-no-files-found: error
-
-      - name: Package release archive
-        shell: bash
-        working-directory: ./target/${{ matrix.settings.target }}/release
-        run: |
-          mkdir -p sync-versions
-          cp ../../../packages/cli/dist/sync-versions/bin.mjs sync-versions/bin.mjs
-          cp ../../../packages/cli/dist/toolchain.json toolchain.json
-          if [ -f vp.exe ]; then
-            7z a "vp-${{ matrix.settings.target }}.zip" vp.exe vp-shim.exe sync-versions/bin.mjs toolchain.json
-          else
-            tar -czf "vp-${{ matrix.settings.target }}.tar.gz" vp sync-versions/bin.mjs toolchain.json
-          fi
+          - name: Upload Rust CLI binary artifact
+            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            with:
+              name: vp-global-cli-${{ matrix.settings.target }}
+              path: |
+                ./target/${{ matrix.settings.target }}/release/vp
+                ./target/${{ matrix.settings.target }}/release/vp.exe
+                ./target/${{ matrix.settings.target }}/release/vp-shim.exe
+              if-no-files-found: error
+
+          - name: Package release archive
+            shell: bash
+            working-directory: ./target/${{ matrix.settings.target }}/release
+            run: |
+              mkdir -p sync-versions
+              cp ../../../packages/cli/dist/sync-versions/bin.mjs sync-versions/bin.mjs
+              cp ../../../packages/cli/dist/toolchain.json toolchain.json
+              if [ -f vp.exe ]; then
+                7z a "vp-${{ matrix.settings.target }}.zip" vp.exe vp-shim.exe sync-versions/bin.mjs toolchain.json
+              else
+                tar -czf "vp-${{ matrix.settings.target }}.tar.gz" vp sync-versions/bin.mjs toolchain.json
+              fi
 
       - name: Verify packaged sync-versions planner
         if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
@@ -188,66 +190,68 @@ jobs:
             }
           ' "${archive_dir}/plan.json" "${VERSION}"
 
-      - name: Upload release archive
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: vp-release-archive-${{ matrix.settings.target }}
-          path: |
-            ./target/${{ matrix.settings.target }}/release/vp-*.tar.gz
-            ./target/${{ matrix.settings.target }}/release/vp-*.zip
-          if-no-files-found: error
-
-      - name: Upload installer binary artifact (Windows only)
-        if: contains(matrix.settings.target, 'windows')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: vp-setup-${{ matrix.settings.target }}
-          path: ./target/${{ matrix.settings.target }}/release/vp-setup.exe
-          if-no-files-found: error
+      - parallel:
+          - name: Upload release archive
+            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            with:
+              name: vp-release-archive-${{ matrix.settings.target }}
+              path: |
+                ./target/${{ matrix.settings.target }}/release/vp-*.tar.gz
+                ./target/${{ matrix.settings.target }}/release/vp-*.zip
+              if-no-files-found: error
+
+          - name: Upload installer binary artifact (Windows only)
+            if: contains(matrix.settings.target, 'windows')
+            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            with:
+              name: vp-setup-${{ matrix.settings.target }}
+              path: ./target/${{ matrix.settings.target }}/release/vp-setup.exe
+              if-no-files-found: error
 
       - name: Remove .node files before upload dist
         if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
         run: |
           rm ./packages/core/dist/**/*.node
 
-      - name: Upload core dist
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-        with:
-          name: core
-          path: ./packages/core/dist
-          if-no-files-found: error
+      - parallel:
+          - name: Upload core dist
+            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+            with:
+              name: core
+              path: ./packages/core/dist
+              if-no-files-found: error
 
-      - name: Upload prompts dist
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-        with:
-          name: prompts
-          path: ./packages/prompts/dist
-          if-no-files-found: error
+          - name: Upload prompts dist
+            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+            with:
+              name: prompts
+              path: ./packages/prompts/dist
+              if-no-files-found: error
 
-      - name: Upload cli dist
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-        with:
-          name: cli
-          path: ./packages/cli/dist
-          if-no-files-found: error
+          - name: Upload cli dist
+            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+            with:
+              name: cli
+              path: ./packages/cli/dist
+              if-no-files-found: error
 
-      - name: Upload cli docs
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-        with:
-          name: cli-docs
-          path: ./packages/cli/docs
-          if-no-files-found: error
+          - name: Upload cli docs
+            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+            with:
+              name: cli-docs
+              path: ./packages/cli/docs
+              if-no-files-found: error
 
-      - name: Upload LICENSE files
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-        with:
-          name: licenses
-          path: |
-            ./packages/core/LICENSE
-            ./packages/cli/LICENSE
-          if-no-files-found: error
+          - name: Upload LICENSE files
+            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+            with:
+              name: licenses
+              path: |
+                ./packages/core/LICENSE
+                ./packages/cli/LICENSE
+              if-no-files-found: error
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 824b424829..2c85b6bfa6 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -45,4 +45,4 @@ jobs:
         shell: bash
         run: git remote remove origin
 
-      - uses: oxc-project/security-action@2ac862d109c9728f5bf439d249b69f68905a5de4 # v1.0.8
+      - uses: oxc-project/security-action@12d013ba60a82c2a7d0ef35bbe38249dc7f7cf1a # v1.0.9
diff --git a/.github/workflows/update-node-release-keys.yml b/.github/workflows/update-node-release-keys.yml
index 5143d1ad88..c05ca023d7 100644
--- a/.github/workflows/update-node-release-keys.yml
+++ b/.github/workflows/update-node-release-keys.yml
@@ -32,6 +32,8 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Create or update PR
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
diff --git a/.github/workflows/update-trusted-stack-stats.yml b/.github/workflows/update-trusted-stack-stats.yml
index c0b3e82c0d..c174b1eae3 100644
--- a/.github/workflows/update-trusted-stack-stats.yml
+++ b/.github/workflows/update-trusted-stack-stats.yml
@@ -35,6 +35,8 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Create or update PR
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
diff --git a/.github/workflows/upgrade-deps.yml b/.github/workflows/upgrade-deps.yml
index 40d5988f2b..e289bfcfa5 100644
--- a/.github/workflows/upgrade-deps.yml
+++ b/.github/workflows/upgrade-deps.yml
@@ -374,6 +374,8 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Close and delete previous PR
         env:

From 283ecf4937822409760e2515079e6dd90e13921a Mon Sep 17 00:00:00 2001
From: MK <fengmk2@gmail.com>
Date: Fri, 9 Oct 2026 16:16:16 +0800
Subject: [PATCH 2/5] perf(ci): overlap setup and checks with dependent work

---
 .github/workflows/ci.yml                     | 178 +++++++++++--------
 .github/workflows/e2e-test.yml               |  15 +-
 .github/workflows/reusable-release-build.yml |  96 +++++-----
 3 files changed, 164 insertions(+), 125 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 984f3e1bd0..4aa14eb942 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -328,6 +328,10 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+        id: node-setup
+        background: true
+
       - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
         with:
           save-cache: ${{ github.ref_name == 'main' }}
@@ -335,19 +339,21 @@ jobs:
           tools: just,cargo-shear
           components: clippy rust-docs rustfmt
 
-      - parallel:
-          - run: |
-              cargo shear
-              cargo fmt --check
-              cargo fmt --manifest-path crates/vp_trampoline/Cargo.toml --check
-              just lint
-              # RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --document-private-items
-
-          - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
-            with:
-              files: .
+      - name: Rust lint
+        id: rust-lint
+        background: true
+        run: |
+          cargo shear
+          cargo fmt --check
+          cargo fmt --manifest-path crates/vp_trampoline/Cargo.toml --check
+          just lint
+          # RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --document-private-items
 
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+        with:
+          files: .
+
+      - wait: node-setup
 
       - name: Install docs dependencies
         run: pnpm -C docs install --frozen-lockfile
@@ -358,6 +364,8 @@ jobs:
       - name: Deduplicate dependencies
         run: pnpm dedupe --check || pnpm dedupe --check
 
+      - wait: rust-lint
+
   # Cross-compiles the Windows release NAPI binding (vite-plus .node) and CLI
   # binaries (vp.exe, vp-shim.exe, vp-setup.exe) on a fast Linux runner with
   # cargo-xwin, then publishes them as the windows-cli-binaries artifact. The
@@ -1044,6 +1052,39 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
+      # Fish and Zsh can both use apt or Homebrew; keep their installs sequential.
+      - name: Install snapshot shells
+        id: snapshot-shells
+        background: true
+        run: |
+          if ! command -v fish >/dev/null 2>&1; then
+            if [ "$RUNNER_OS" = 'Linux' ]; then
+              sudo apt-get update
+              sudo apt-get install --yes fish
+            else
+              brew install fish
+            fi
+          fi
+          fish --version
+
+          if ! command -v zsh >/dev/null 2>&1; then
+            if [ "$RUNNER_OS" = 'Linux' ]; then
+              sudo apt-get update
+              sudo apt-get install --yes zsh
+            else
+              brew install zsh
+            fi
+          fi
+          zsh --version
+
+      # https://github.com/marketplace/actions/setup-nu
+      - name: Install Nushell
+        id: nushell
+        background: true
+        uses: hustcer/setup-nu@ccd5bb5426b05a32009c2ba967946231f3919c97 # v3.25
+        with:
+          version: '*'
+
       - parallel:
           - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
@@ -1059,6 +1100,13 @@ jobs:
               name: cli-test-binaries-${{ matrix.target }}
               path: ${{ runner.temp }}
 
+      - name: Install Playwright Chromium
+        id: playwright
+        background: true
+        run: pnpm exec playwright install chromium
+        env:
+          PLAYWRIGHT_BROWSERS_PATH: '0'
+
       - name: Extract CLI test binaries
         run: tar -xzf "$RUNNER_TEMP/cli-test-binaries.tar.gz"
 
@@ -1071,51 +1119,16 @@ jobs:
       - name: Install Global CLI vp
         run: pnpm bootstrap-cli:ci
 
-      # Fish and Zsh can both use apt or Homebrew; keep their installs sequential.
-      - name: Ensure Fish is installed
-        run: |
-          if ! command -v fish >/dev/null 2>&1; then
-            if [ "$RUNNER_OS" = 'Linux' ]; then
-              sudo apt-get update
-              sudo apt-get install --yes fish
-            else
-              brew install fish
-            fi
-          fi
-          fish --version
-
-      - name: Ensure Zsh is installed
+      # Provision the managed runtime once into the real home so cases can
+      # seed from it (seed-runtime) instead of each downloading ~50MB.
+      # Best-effort: without a seed, cases that need the runtime download it
+      # themselves.
+      - name: Prewarm managed runtime
         run: |
-          if ! command -v zsh >/dev/null 2>&1; then
-            if [ "$RUNNER_OS" = 'Linux' ]; then
-              sudo apt-get update
-              sudo apt-get install --yes zsh
-            else
-              brew install zsh
-            fi
-          fi
-          zsh --version
-
-      - parallel:
-          # https://github.com/marketplace/actions/setup-nu
-          - name: Install Nushell
-            uses: hustcer/setup-nu@ccd5bb5426b05a32009c2ba967946231f3919c97 # v3.25
-            with:
-              version: '*'
+          "$HOME/.vite-plus/bin/vp" node --version \
+            || echo "prewarm failed; cases will download the runtime on demand"
 
-          # Provision the managed runtime once into the real home so cases can
-          # seed from it (seed-runtime) instead of each downloading ~50MB.
-          # Best-effort: without a seed, cases that need the runtime download it
-          # themselves.
-          - name: Prewarm managed runtime
-            run: |
-              "$HOME/.vite-plus/bin/vp" node --version \
-                || echo "prewarm failed; cases will download the runtime on demand"
-
-          - name: Install Playwright Chromium
-            run: pnpm exec playwright install chromium
-            env:
-              PLAYWRIGHT_BROWSERS_PATH: '0'
+      - wait: [snapshot-shells, nushell, playwright]
 
       - name: Run PTY snapshot tests
         run: |
@@ -1190,6 +1203,18 @@ jobs:
         shell: bash
         run: mkdir -p "$TEMP" "$TMP"
 
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        id: snapshot-archive
+        background: true
+        with:
+          name: windows-snapshot-test-archive
+
+      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+        id: nextest
+        background: true
+        with:
+          tool: cargo-nextest
+
       - parallel:
           - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
@@ -1205,6 +1230,14 @@ jobs:
             with:
               name: windows-cli-binaries
 
+      - name: Install Playwright Chromium
+        id: playwright
+        background: true
+        shell: bash
+        run: pnpm exec playwright install chromium
+        env:
+          PLAYWRIGHT_BROWSERS_PATH: '0'
+
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
         with:
@@ -1215,30 +1248,15 @@ jobs:
         shell: bash
         run: pnpm bootstrap-cli:ci
 
-      - parallel:
-          # Provision the managed runtime once into the real home so cases can
-          # seed from it (seed-runtime) instead of each downloading ~50MB.
-          # Best-effort: without a seed, cases that need the runtime download it
-          # themselves.
-          - name: Prewarm managed runtime
-            shell: bash
-            run: |
-              "$USERPROFILE/.vite-plus/bin/vp.exe" node --version \
-                || echo "prewarm failed; cases will download the runtime on demand"
-
-          - name: Install Playwright Chromium
-            shell: bash
-            run: pnpm exec playwright install chromium
-            env:
-              PLAYWRIGHT_BROWSERS_PATH: '0'
-
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: windows-snapshot-test-archive
-
-          - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-            with:
-              tool: cargo-nextest
+      # Provision the managed runtime once into the real home so cases can
+      # seed from it (seed-runtime) instead of each downloading ~50MB.
+      # Best-effort: without a seed, cases that need the runtime download it
+      # themselves.
+      - name: Prewarm managed runtime
+        shell: bash
+        run: |
+          "$USERPROFILE/.vite-plus/bin/vp.exe" node --version \
+            || echo "prewarm failed; cases will download the runtime on demand"
 
       # Keep fixtures outside runner.temp: setup-node writes an .npmrc there,
       # which Yarn Classic discovers when walking parent directories.
@@ -1252,6 +1270,8 @@ jobs:
           New-Item -ItemType Directory -Path $snapshotTemp | Out-Null
           "directory=$snapshotTemp" >> $env:GITHUB_OUTPUT
 
+      - wait: [playwright, snapshot-archive, nextest]
+
       # `cargo-nextest` is invoked directly so the job never depends on the
       # runner's Rust toolchain. --workspace-remap makes nextest rewrite
       # CARGO_MANIFEST_DIR and CARGO_BIN_EXE_vpt to this checkout, which is
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 0e3ff397d3..8f1aa461a4 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -504,8 +504,17 @@ jobs:
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
-        with:
-          ecosystem-ci-project: ${{ matrix.project.name }}
+
+      # The project clone only needs the bootstrap Node.js from the clone action.
+      - name: Clone ecosystem project
+        id: ecosystem-project
+        background: true
+        shell: bash
+        run: |
+          git config --global core.autocrlf false
+          node ecosystem-ci/clone.ts "$ECOSYSTEM_PROJECT"
+        env:
+          ECOSYSTEM_PROJECT: ${{ matrix.project.name }}
 
       # Disable Windows Defender real-time scanning to speed up I/O-heavy operations
       - name: Disable Windows Defender
@@ -546,6 +555,8 @@ jobs:
           # so cmd.exe and Node.js execSync can resolve binaries in PATH
           echo "${USERPROFILE:-$HOME}/.vite-plus/bin" >> $GITHUB_PATH
 
+      - wait: ecosystem-project
+
       - name: Migrate in ${{ matrix.project.name }}
         working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
         shell: bash
diff --git a/.github/workflows/reusable-release-build.yml b/.github/workflows/reusable-release-build.yml
index 7f4205ccf2..46a1cf678b 100644
--- a/.github/workflows/reusable-release-build.yml
+++ b/.github/workflows/reusable-release-build.yml
@@ -118,36 +118,39 @@ jobs:
         with:
           target: ${{ matrix.settings.target }}
 
-      - parallel:
-          - name: Upload Vite+ native artifact
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            with:
-              name: vite-plus-native-${{ matrix.settings.target }}
-              path: ./packages/cli/binding/*.node
-              if-no-files-found: error
+      - name: Upload Vite+ native artifact
+        id: native-upload
+        background: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vite-plus-native-${{ matrix.settings.target }}
+          path: ./packages/cli/binding/*.node
+          if-no-files-found: error
 
-          - name: Upload Rust CLI binary artifact
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            with:
-              name: vp-global-cli-${{ matrix.settings.target }}
-              path: |
-                ./target/${{ matrix.settings.target }}/release/vp
-                ./target/${{ matrix.settings.target }}/release/vp.exe
-                ./target/${{ matrix.settings.target }}/release/vp-shim.exe
-              if-no-files-found: error
+      - name: Upload Rust CLI binary artifact
+        id: cli-upload
+        background: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vp-global-cli-${{ matrix.settings.target }}
+          path: |
+            ./target/${{ matrix.settings.target }}/release/vp
+            ./target/${{ matrix.settings.target }}/release/vp.exe
+            ./target/${{ matrix.settings.target }}/release/vp-shim.exe
+          if-no-files-found: error
 
-          - name: Package release archive
-            shell: bash
-            working-directory: ./target/${{ matrix.settings.target }}/release
-            run: |
-              mkdir -p sync-versions
-              cp ../../../packages/cli/dist/sync-versions/bin.mjs sync-versions/bin.mjs
-              cp ../../../packages/cli/dist/toolchain.json toolchain.json
-              if [ -f vp.exe ]; then
-                7z a "vp-${{ matrix.settings.target }}.zip" vp.exe vp-shim.exe sync-versions/bin.mjs toolchain.json
-              else
-                tar -czf "vp-${{ matrix.settings.target }}.tar.gz" vp sync-versions/bin.mjs toolchain.json
-              fi
+      - name: Package release archive
+        shell: bash
+        working-directory: ./target/${{ matrix.settings.target }}/release
+        run: |
+          mkdir -p sync-versions
+          cp ../../../packages/cli/dist/sync-versions/bin.mjs sync-versions/bin.mjs
+          cp ../../../packages/cli/dist/toolchain.json toolchain.json
+          if [ -f vp.exe ]; then
+            7z a "vp-${{ matrix.settings.target }}.zip" vp.exe vp-shim.exe sync-versions/bin.mjs toolchain.json
+          else
+            tar -czf "vp-${{ matrix.settings.target }}.tar.gz" vp sync-versions/bin.mjs toolchain.json
+          fi
 
       - name: Verify packaged sync-versions planner
         if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
@@ -190,23 +193,26 @@ jobs:
             }
           ' "${archive_dir}/plan.json" "${VERSION}"
 
-      - parallel:
-          - name: Upload release archive
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            with:
-              name: vp-release-archive-${{ matrix.settings.target }}
-              path: |
-                ./target/${{ matrix.settings.target }}/release/vp-*.tar.gz
-                ./target/${{ matrix.settings.target }}/release/vp-*.zip
-              if-no-files-found: error
+      - name: Upload release archive
+        id: archive-upload
+        background: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vp-release-archive-${{ matrix.settings.target }}
+          path: |
+            ./target/${{ matrix.settings.target }}/release/vp-*.tar.gz
+            ./target/${{ matrix.settings.target }}/release/vp-*.zip
+          if-no-files-found: error
 
-          - name: Upload installer binary artifact (Windows only)
-            if: contains(matrix.settings.target, 'windows')
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            with:
-              name: vp-setup-${{ matrix.settings.target }}
-              path: ./target/${{ matrix.settings.target }}/release/vp-setup.exe
-              if-no-files-found: error
+      - name: Upload installer binary artifact (Windows only)
+        id: installer-upload
+        background: true
+        if: contains(matrix.settings.target, 'windows')
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vp-setup-${{ matrix.settings.target }}
+          path: ./target/${{ matrix.settings.target }}/release/vp-setup.exe
+          if-no-files-found: error
 
       - name: Remove .node files before upload dist
         if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
@@ -255,3 +261,5 @@ jobs:
                 ./packages/core/LICENSE
                 ./packages/cli/LICENSE
               if-no-files-found: error
+
+      - wait: [native-upload, cli-upload, archive-upload, installer-upload]

From 1687caf917b0fd8935eb21df77a62ce04828461b Mon Sep 17 00:00:00 2001
From: MK <fengmk2@gmail.com>
Date: Sat, 10 Oct 2026 19:23:08 +0800
Subject: [PATCH 3/5] perf(ci): remove platform waits and reuse native test
 binaries

---
 .../download-cli-test-binaries/action.yml     |  20 +
 .github/workflows/ci.yml                      | 287 +++++-----
 .github/workflows/e2e-test.yml                | 518 +-----------------
 .github/workflows/reusable-ecosystem-ci.yml   | 512 +++++++++++++++++
 .github/workflows/reusable-release-build.yml  |  92 ++--
 5 files changed, 715 insertions(+), 714 deletions(-)
 create mode 100644 .github/actions/download-cli-test-binaries/action.yml
 create mode 100644 .github/workflows/reusable-ecosystem-ci.yml

diff --git a/.github/actions/download-cli-test-binaries/action.yml b/.github/actions/download-cli-test-binaries/action.yml
new file mode 100644
index 0000000000..b492dfedcc
--- /dev/null
+++ b/.github/actions/download-cli-test-binaries/action.yml
@@ -0,0 +1,20 @@
+name: Download CLI test binaries
+description: Restore the native CLI, bindings, metadata, and snapshot runner from the platform build.
+
+inputs:
+  target:
+    description: The Rust target built by build-cli-test-binaries.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: cli-test-binaries-${{ inputs.target }}
+        path: ${{ runner.temp }}
+
+    # The tar archive preserves executable permissions and workspace paths.
+    - name: Extract CLI test binaries
+      shell: bash
+      run: tar -xzf "$RUNNER_TEMP/cli-test-binaries.tar.gz"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4aa14eb942..aaff7973c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,15 +69,14 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - parallel:
-          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-            with:
-              # Shares the Cargo cache with the Linux CLI test build job, which
-              # builds the same target. Only that job saves it.
-              save-cache: false
-              cache-key: cli-snapshot-test-x86_64-unknown-linux-gnu
+      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+        with:
+          # Shares the Cargo cache with the Linux CLI test build job, which
+          # builds the same target. Only that job saves it.
+          save-cache: false
+          cache-key: cli-snapshot-test-x86_64-unknown-linux-gnu
 
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
       # Format-check with the oxfmt of this commit instead of the released one.
       # A release carries the oxfmt it shipped with, which trails the catalog
@@ -202,25 +201,24 @@ jobs:
           cargo nextest archive $(for d in crates/*/; do n=$(basename $d); [ "$n" = "vp_cli_snapshots" ] || [ "$n" = "vp_trampoline" ] || echo -n "-p $n "; done) -p vite-plus-cli \
             --target x86_64-pc-windows-msvc --archive-file windows-tests.tar.zst
 
-      - parallel:
-          - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            with:
-              name: windows-test-archive
-              path: windows-tests.tar.zst
-              retention-days: 7
-
-          # Separate archive for the PTY snapshot suite (excluded from the
-          # unit-test archive above): its suite needs vp, node, and a built
-          # packages/cli/dist at runtime, which only cli-snapshot-test-windows
-          # provides. The archive carries the cli_snapshots test binary plus the
-          # vpt helper; nextest rewrites CARGO_MANIFEST_DIR/CARGO_BIN_EXE_vpt at
-          # run time so the relocated binaries find fixtures and helpers.
-          - name: Build snapshot test archive
-            run: |
-              eval "$(cargo xwin env --target x86_64-pc-windows-msvc | grep '^export ')"
-              unset RUSTFLAGS
-              cargo nextest archive -p vp_cli_snapshots \
-                --target x86_64-pc-windows-msvc --archive-file windows-snapshot-tests.tar.zst
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: windows-test-archive
+          path: windows-tests.tar.zst
+          retention-days: 7
+
+      # Separate archive for the PTY snapshot suite (excluded from the
+      # unit-test archive above): its suite needs vp, node, and a built
+      # packages/cli/dist at runtime, which only cli-snapshot-test-windows
+      # provides. The archive carries the cli_snapshots test binary plus the
+      # vpt helper; nextest rewrites CARGO_MANIFEST_DIR/CARGO_BIN_EXE_vpt at
+      # run time so the relocated binaries find fixtures and helpers.
+      - name: Build snapshot test archive
+        run: |
+          eval "$(cargo xwin env --target x86_64-pc-windows-msvc | grep '^export ')"
+          unset RUSTFLAGS
+          cargo nextest archive -p vp_cli_snapshots \
+            --target x86_64-pc-windows-msvc --archive-file windows-snapshot-tests.tar.zst
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -236,14 +234,13 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - parallel:
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: windows-test-archive
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: windows-test-archive
 
-          - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-            with:
-              tool: cargo-nextest
+      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+        with:
+          tool: cargo-nextest
 
       # `cargo-nextest` is invoked directly so the job never depends on the
       # runner's Rust toolchain.
@@ -329,8 +326,6 @@ jobs:
       - uses: ./.github/actions/clone
 
       - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
-        id: node-setup
-        background: true
 
       - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
         with:
@@ -353,8 +348,6 @@ jobs:
         with:
           files: .
 
-      - wait: node-setup
-
       - name: Install docs dependencies
         run: pnpm -C docs install --frozen-lockfile
 
@@ -413,37 +406,30 @@ jobs:
 
       - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-      - parallel:
-          - name: Install docs dependencies
-            run: pnpm -C docs install --frozen-lockfile
-
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: rolldown-binaries
-              path: ./rolldown/packages/rolldown/src
-              merge-multiple: true
-
-          # Prebuilt by build-windows-cli (Linux + cargo-xwin); the artifact
-          # paths are workspace-relative, so this places the binding into
-          # packages/cli/binding/ and the CLI binaries into
-          # target/x86_64-pc-windows-msvc/release/ where
-          # `tool install-global-cli` finds them.
-          - name: Download prebuilt Windows binaries
-            if: runner.os == 'Windows'
-            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: windows-cli-binaries
-
-          - name: Download prebuilt CLI test binaries
-            if: runner.os != 'Windows'
-            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: cli-test-binaries-${{ matrix.target }}
-              path: ${{ runner.temp }}
-
-      - name: Extract CLI test binaries
+      - name: Install docs dependencies
+        run: pnpm -C docs install --frozen-lockfile
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
+
+      # Prebuilt by build-windows-cli (Linux + cargo-xwin); the artifact
+      # paths are workspace-relative, so this places the binding into
+      # packages/cli/binding/ and the CLI binaries into
+      # target/x86_64-pc-windows-msvc/release/ where
+      # `tool install-global-cli` finds them.
+      - name: Download prebuilt Windows binaries
+        if: runner.os == 'Windows'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: windows-cli-binaries
+
+      - uses: ./.github/actions/download-cli-test-binaries
         if: runner.os != 'Windows'
-        run: tar -xzf "$RUNNER_TEMP/cli-test-binaries.tar.gz"
+        with:
+          target: ${{ matrix.target }}
 
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
@@ -964,19 +950,18 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - parallel:
-          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-            with:
-              save-cache: ${{ github.ref_name == 'main' }}
-              cache-key: cli-snapshot-test-${{ matrix.target }}
+      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+        with:
+          save-cache: ${{ github.ref_name == 'main' }}
+          cache-key: cli-snapshot-test-${{ matrix.target }}
 
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: rolldown-binaries
-              path: ./rolldown/packages/rolldown/src
-              merge-multiple: true
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
 
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
@@ -1079,26 +1064,21 @@ jobs:
 
       # https://github.com/marketplace/actions/setup-nu
       - name: Install Nushell
-        id: nushell
-        background: true
         uses: hustcer/setup-nu@ccd5bb5426b05a32009c2ba967946231f3919c97 # v3.25
         with:
           version: '*'
 
-      - parallel:
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: rolldown-binaries
-              path: ./rolldown/packages/rolldown/src
-              merge-multiple: true
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
 
-          - name: Download prebuilt CLI test binaries
-            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: cli-test-binaries-${{ matrix.target }}
-              path: ${{ runner.temp }}
+      - uses: ./.github/actions/download-cli-test-binaries
+        with:
+          target: ${{ matrix.target }}
 
       - name: Install Playwright Chromium
         id: playwright
@@ -1107,9 +1087,6 @@ jobs:
         env:
           PLAYWRIGHT_BROWSERS_PATH: '0'
 
-      - name: Extract CLI test binaries
-        run: tar -xzf "$RUNNER_TEMP/cli-test-binaries.tar.gz"
-
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
         with:
@@ -1128,7 +1105,7 @@ jobs:
           "$HOME/.vite-plus/bin/vp" node --version \
             || echo "prewarm failed; cases will download the runtime on demand"
 
-      - wait: [snapshot-shells, nushell, playwright]
+      - wait: [snapshot-shells, playwright]
 
       - name: Run PTY snapshot tests
         run: |
@@ -1204,31 +1181,26 @@ jobs:
         run: mkdir -p "$TEMP" "$TMP"
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        id: snapshot-archive
-        background: true
         with:
           name: windows-snapshot-test-archive
 
       - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
-        id: nextest
-        background: true
         with:
           tool: cargo-nextest
 
-      - parallel:
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: rolldown-binaries
-              path: ./rolldown/packages/rolldown/src
-              merge-multiple: true
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
 
-          # See the cli-e2e-test job for details on the prebuilt binaries.
-          - name: Download prebuilt Windows binaries
-            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: windows-cli-binaries
+      # See the cli-e2e-test job for details on the prebuilt binaries.
+      - name: Download prebuilt Windows binaries
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: windows-cli-binaries
 
       - name: Install Playwright Chromium
         id: playwright
@@ -1270,7 +1242,7 @@ jobs:
           New-Item -ItemType Directory -Path $snapshotTemp | Out-Null
           "directory=$snapshotTemp" >> $env:GITHUB_OUTPUT
 
-      - wait: [playwright, snapshot-archive, nextest]
+      - wait: playwright
 
       # `cargo-nextest` is invoked directly so the job never depends on the
       # runner's Rust toolchain. --workspace-remap makes nextest rewrite
@@ -1346,19 +1318,18 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - parallel:
-          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-            with:
-              save-cache: ${{ github.ref_name == 'main' }}
-              cache-key: cli-e2e-test-musl
+      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+        with:
+          save-cache: ${{ github.ref_name == 'main' }}
+          cache-key: cli-e2e-test-musl
 
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: rolldown-binaries
-              path: ./rolldown/packages/rolldown/src
-              merge-multiple: true
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
 
       # Cross-compile for musl on the glibc host
       - name: Build with upstream (musl)
@@ -1475,7 +1446,7 @@ jobs:
   install-e2e-test:
     name: Local CLI `vp install` E2E test
     needs:
-      - download-previous-rolldown-binaries
+      - build-cli-test-binaries
     runs-on: namespace-profile-linux-x64-default
     # Run if: not a PR, OR PR has 'test: install-e2e' label
     if: >-
@@ -1485,24 +1456,23 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      - parallel:
-          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-            with:
-              save-cache: ${{ github.ref_name == 'main' }}
-              cache-key: install-e2e-test
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
 
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: rolldown-binaries
-              path: ./rolldown/packages/rolldown/src
-              merge-multiple: true
+      - uses: ./.github/actions/download-cli-test-binaries
+        with:
+          target: x86_64-unknown-linux-gnu
 
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
         with:
           target: x86_64-unknown-linux-gnu
+          skip-native: true
 
       - name: Build CLI
         run: |
@@ -1557,8 +1527,7 @@ jobs:
       # Override vp's project pins; sfw's embedded Node runtime is separate.
       VP_NODE_VERSION: '24.21.0'
     needs:
-      - download-previous-rolldown-binaries
-      - build-windows-cli
+      - build-cli-test-binaries
     # Run if: not a PR (push-to-main / workflow_dispatch), OR PR has 'test: sfw' label.
     # Heavy job (real registry traffic) — gated to avoid running on every PR.
     if: >-
@@ -1584,7 +1553,8 @@ jobs:
             sfw_asset: sfw-free-macos-arm64
             vp_bin: vp
             vp_insecure_tls: ''
-          # TODO: Re-enable Windows when SFW's embedded Node includes
+          # TODO: Restore Windows in a separate job that needs build-windows-cli
+          # when SFW's embedded Node includes
           # https://github.com/nodejs/node/pull/61999 (Node 24.20.0 / 26.7.0).
           # SFW 1.15.2 embeds Node 24.9.0 and hits UV_HANDLE_CLOSING at shutdown.
           # VP_NODE_VERSION only changes the child runtime, not SFW's runtime.
@@ -1599,35 +1569,24 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      # Windows runs against the prebuilt binaries from build-windows-cli,
-      # so it needs no Rust toolchain or dev drive here.
-      - parallel:
-          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-            if: runner.os != 'Windows'
-            with:
-              save-cache: ${{ github.ref_name == 'main' }}
-              cache-key: install-e2e-test-sfw-${{ matrix.os }}
-
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
-
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: rolldown-binaries
-              path: ./rolldown/packages/rolldown/src
-              merge-multiple: true
-
-          # See the cli-e2e-test job for details on the prebuilt binaries.
-          - name: Download prebuilt Windows binaries
-            if: runner.os == 'Windows'
-            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: windows-cli-binaries
+      # Reuse the platform build instead of compiling the same native code again.
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
+
+      - uses: ./.github/actions/download-cli-test-binaries
+        with:
+          target: ${{ matrix.target }}
 
       - name: Build with upstream
         uses: ./.github/actions/build-upstream
         with:
           target: ${{ matrix.target }}
-          skip-native: ${{ runner.os == 'Windows' }}
+          skip-native: true
 
       - name: Build CLI
         run: |
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 8f1aa461a4..4651c7d4d2 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -40,6 +40,7 @@ jobs:
             related-files:
               - 'packages/**/build.ts'
               - .github/workflows/e2e-test.yml
+              - .github/workflows/reusable-ecosystem-ci.yml
               - 'ecosystem-ci/*'
 
   download-previous-rolldown-binaries:
@@ -62,10 +63,10 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
   # Cross-compile the Windows vite-plus binding + vp binaries on Linux so the
-  # build job's windows-latest entry only runs the (fast) JS/pack pass with
+  # Windows package build only runs the (fast) JS/pack pass with
   # skip-native, instead of the ~24m native Rust compile. The core/rolldown
   # bundling stays on Windows (it is host-platform specific), so this can't be
-  # folded into the build job. Shares ci.yml's windows-cli-xwin cache.
+  # folded into the cross-compile job. Shares ci.yml's windows-cli-xwin cache.
   build-windows-cli:
     needs: detect-changes
     if: >-
@@ -86,515 +87,36 @@ jobs:
         with:
           save-cache: ${{ github.ref_name == 'main' }}
 
-  build:
-    name: Build vite-plus packages (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
+  # Each platform starts its tests as soon as its own packages are ready.
+  # Linux does not consume the cross-compiled Windows binaries.
+  linux:
+    name: Linux ecosystem
+    needs: download-previous-rolldown-binaries
     permissions:
       contents: read
       packages: read
+    uses: ./.github/workflows/reusable-ecosystem-ci.yml
+    with:
+      runner: ubuntu-latest
+      target: x86_64-unknown-linux-gnu
+
+  windows:
+    name: Windows ecosystem
     needs:
       - download-previous-rolldown-binaries
       - build-windows-cli
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            target: x86_64-unknown-linux-gnu
-          - os: namespace-profile-windows-4c-8g
-            target: x86_64-pc-windows-msvc
-    steps:
-      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: ./.github/actions/clone
-
-      # Disable Windows Defender real-time scanning to speed up I/O-heavy builds (~30-50% faster)
-      - name: Disable Windows Defender
-        if: runner.os == 'Windows'
-        continue-on-error: true
-        shell: powershell
-        run: Set-MpPreference -DisableRealtimeMonitoring $true
-
-      # Windows builds against the prebuilt binaries from build-windows-cli, so
-      # it needs no Rust toolchain here.
-      - parallel:
-          - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
-            if: ${{ !contains(matrix.target, 'windows') }}
-            with:
-              save-cache: ${{ github.ref_name == 'main' }}
-              cache-key: e2e-build-${{ matrix.os }}
-
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
-
-          - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: rolldown-binaries
-              path: ./rolldown/packages/rolldown/src
-              merge-multiple: true
-
-          # Prebuilt by build-windows-cli (Linux + cargo-xwin); placed where
-          # build-upstream's skip-native pass and the pack step expect them.
-          - name: Download prebuilt Windows binaries
-            if: contains(matrix.target, 'windows')
-            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: windows-cli-binaries
-
-      - name: Build with upstream
-        uses: ./.github/actions/build-upstream
-        with:
-          target: ${{ matrix.target }}
-          skip-native: ${{ contains(matrix.target, 'windows') }}
-
-      - name: Pack packages into tgz
-        run: |
-          mkdir -p tmp/tgz
-          # patch-project.ts serves these tgz through a local npm registry
-          # (packages/tools/src/local-npm-registry.ts), so `vp migrate` pins
-          # and installs them like a real release, with every package manager
-          # (including bun) resolving the standard
-          # `vite -> npm:@voidzero-dev/vite-plus-core@<version>` alias. Pin
-          # both packages to 0.0.0 so a correctly installed local build is
-          # always distinguishable from any published version
-          # (verify-install.ts asserts it), even on a release commit that
-          # leaves packages/{core,cli} at a published version.
-          (cd packages/core && npm pkg set version=0.0.0)
-          (cd packages/cli && npm pkg set version=0.0.0)
-          cd packages/core && pnpm pack --pack-destination ../../tmp/tgz && cd ../..
-          cd packages/cli && pnpm pack --pack-destination ../../tmp/tgz && cd ../..
-          # Copy vp binary for e2e-test job (findVpBinary expects it in target/)
-          cp target/${{ matrix.target }}/release/vp tmp/tgz/vp 2>/dev/null || cp target/${{ matrix.target }}/release/vp.exe tmp/tgz/vp.exe 2>/dev/null || true
-          cp target/${{ matrix.target }}/release/vp-shim.exe tmp/tgz/vp-shim.exe 2>/dev/null || true
-          ls -la tmp/tgz
-
-      - name: Upload tgz artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: vite-plus-packages-${{ matrix.os }}
-          path: tmp/tgz/
-          retention-days: 1
-
-  e2e-test:
-    name: ${{ matrix.project.name }} E2E test (${{ matrix.os }})
-    env:
-      # For packing manager install from github package registry
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     permissions:
       contents: read
       packages: read
-    needs:
-      - build
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: ${{ matrix.project.timeout || 10 }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - namespace-profile-windows-4c-8g
-        project:
-          - name: vibe-dashboard
-            node-version: 24
-            command: |
-              # FIXME: Failed to load JS plugin: ./plugins/debugger.js
-              # vp run ready
-              vp fmt
-              # Avoid Windows dynamic port reservations around Vitest's default 63315.
-              vp test --api.port=3000
-              vp run build
-          # FIXME: TypeError: Failed to fetch dynamically imported module
-          # - name: skeleton
-          #   node-version: 24
-          #   command: |
-          #     vp run format
-          #     vp run lint:check
-          #     vp run check
-          #     npx playwright install chromium
-          #     vp run test
-          - name: rollipop
-            node-version: 22
-            command: |
-              vp run -r build
-              # FIXME: typescript-eslint(no-redundant-type-constituents): 'rolldownExperimental.DevEngine' is an 'error' type that acts as 'any' and overrides all other types in this union type.
-              vp run lint || true
-              # FIXME: src/bundler-pool.ts(8,8): error TS2307: Cannot find module '@rollipop/core' or its corresponding type declarations.
-              vp run -r typecheck || true
-              vp run format
-              vp run @rollipop/common#test
-              vp run @rollipop/core#test
-              vp run @rollipop/dev-server#test
-          - name: frm-stack
-            node-version: 24
-            command: |
-              vp run lint:check
-              vp run format:check
-              vp run typecheck
-              vp run @yourcompany/api#test
-              vp run @yourcompany/backend-core#test
-          - name: vue-mini
-            node-version: 24
-            command: |
-              # FIXME: skip format for now, will re-enable after prettier migration support
-              # vp run format
-              # FIXME: oxlint 1.59.0 no-useless-assignment has false positives on module-level
-              # state variables and closure-captured variables (oxc-project/oxc#3022).
-              # The migration sets the rule as "error" in vite.config.ts, so --allow can't override it.
-              vp run lint || true
-              vp run type
-              vp run test -- --coverage
-          # SKIP: vite-plugin-react - vite-task config loading incompatibility
-          # vite-task needs to load vite.config.js for all workspace packages to build the task graph,
-          # but the vite-plus process starts with workspace root as cwd.
-          # The plugin-react-swc playgrounds use SWC plugins (e.g., @swc/plugin-emotion) which
-          # cannot be resolved when loading the config from workspace root.
-          #
-          # Minimal reproduction:
-          #   git clone https://github.com/vitejs/vite-plugin-react /tmp/vite-plugin-react-test
-          #   cd /tmp/vite-plugin-react-test && pnpm install && pnpm run build
-          #   node packages/plugin-react-swc/playground/emotion-plugin/vite.config.js
-          #   # Error: Cannot find module '@swc/plugin-emotion'
-          #
-          # This works when running from within the playground directory (pnpm run build)
-          # because pnpm's symlink structure allows resolution, but fails when loading from workspace root.
-          # - name: vite-plugin-react
-          #   node-version: 22
-          #   command: |
-          #     vp run format
-          #     vp run lint -- --fix
-          #     # TODO(fengmk2): run all builds and tests after tsdown version upgrade
-          #     vp run @vitejs/plugin-rsc#build
-          #     vp run @vitejs/plugin-rsc#test
-          - name: vitepress
-            node-version: 24
-            command: |
-              vp run format
-              vp run build
-              vp test run -r __tests__/unit
-              vp run tests-e2e#test
-              VITE_TEST_BUILD=1 vp run tests-e2e#test
-              vp run tests-init#test
-          - name: tanstack-start-helloworld
-            node-version: 24
-            command: |
-              vp run test
-              vp run build
-          - name: oxlint-plugin-complexity
-            node-version: 22
-            command: |
-              vp run format
-              vp run format:check
-              vp run build
-              vp run lint
-              vp run test:run
-              npx tsc --noEmit
-          - name: decoders
-            node-version: 24
-            command: |
-              vp pack
-              vp test
-          - name: vite-vue-vercel
-            node-version: 24
-            command: |
-              vp run test
-              vp run build
-          - name: dify
-            node-version: 24
-            directory: web
-            # Leave time for tests after migration and the Next.js build.
-            timeout: 20
-            command: |
-              vp run type-check
-              vp run build
-              vp run test real-browser-flicker.test.tsx workflow-onboarding-integration.test.tsx
-          - name: viteplus-ws-repro
-            node-version: 24
-            command: |
-              vp test run
-          - name: vp-config
-            node-version: 22
-            command: |
-              vp check
-              vp pack
-              vp test
-          - name: vinext
-            node-version: 24
-            # The full vinext suite (~7000 tests) outgrew a 15-minute budget
-            # on 4-core runners, so run one shard of the unit project here;
-            # the rest of the suite is covered by vinext's own CI.
-            timeout: 20
-            command: |
-              # vp migrate's auto-install passes --ignore-scripts on pnpm v11
-              # (vinext pins pnpm 11), which skips vinext's approved
-              # better-sqlite3 build, and the follow-up `vp install` never
-              # re-runs it. Rebuild it so the better-auth fixture works.
-              vp rebuild -- -r better-sqlite3
-              vp run build
-              vp check --fix
-              vp run check
-              vp test run --project unit --shard=1/3
-          - name: videojs-v10
-            node-version: 24
-            command: |
-              node $GITHUB_WORKSPACE/ecosystem-ci/verify-videojs-v10.ts
-              # The upstream preset keeps existing diagnostics at warning level.
-              vp lint --quiet
-              vp test run tools/oxlint/anti-slop/rules/tests
-          - name: reactive-resume
-            node-version: 24
-            command: |
-              vp fmt
-              vp lint --type-aware
-              vp build
-              vp test
-          - name: yaak
-            node-version: 24
-            command: |
-              vp fmt
-              # FIXME: type-aware lint fails with "Invalid tsconfig" without full Rust/wasm bootstrap
-              vp lint || true
-              vp test
-          - name: npmx.dev
-            node-version: 24
-            command: |
-              vp fmt
-              vp run lint
-              vp run test:types
-              vp test --project nuxt
-              vp test --project unit
-          - name: codiff
-            node-version: 24
-            timeout: 20
-            command: |
-              # Codiff uses pnpm's default 24-hour release age. Allow newly
-              # published toolchain packages in this ecosystem run.
-              export pnpm_config_minimum_release_age=0
-              export PNPM_CONFIG_MINIMUM_RELEASE_AGE=0
-              # Migration skips install scripts. node-pty has no Linux prebuild,
-              # so build its approved native addon before running the tests.
-              vp pm rebuild node-pty
-              vp run build
-              # The separate Workers integration suite still requires Vitest 4.
-              vp test run
-          - name: vite-plus-jest-dom-repro
-            node-version: 24
-            command: |
-              vp test run
-          - name: bun-vite-template
-            node-version: 24
-            command: |
-              # FIXME: mantine uses postcss-simple-vars (e.g. `@media (max-width:
-              # $mantine-breakpoint-md)` in src/components/Welcome/Welcome.module.css),
-              # which oxfmt's CSS parser does not support yet (regressed in oxfmt 0.57.0
-              # after the switch to oxc-css-parser). Tracking issue:
-              # https://github.com/oxc-project/oxc/issues/23969. Drop the `|| true`
-              # once postcss-simple-vars syntax is supported.
-              vp fmt || true
-              vp run validate
-          - name: vite-plus-vitest-global-type-minimal-repro
-            node-version: 24
-            command: |
-              vp test
-              vp check --fix
-          - name: vitest-playwright-repro
-            node-version: 24
-            command: |
-              vp test
-          - name: vite-plus-vitest-type-aug
-            node-version: 24
-            command: |
-              vp check --fix
-          - name: vite-plus-monorepo-overrides
-            node-version: 24
-            command: |
-              vp check --fix
-              vp run verify
-          - name: varlet
-            node-version: 22
-            command: |
-              node scripts/bootstrap.mjs
-              # Report-only: oxlint 1.68.0 surfaces ts1038 ("A 'declare' modifier
-              # cannot be used in an already ambient context.") on varlet's
-              # packages/varlet-cli/src/module.d.ts, which carries a redundant
-              # `declare` inside an ambient `declare module 'jest'` block. varlet can
-              # only drop the redundant modifier upstream once a vite-plus release
-              # ships oxlint 1.68.0, so don't fail the matrix on it yet. Follow-up:
-              # submit a fix PR to varletjs/varlet after the next vite-plus release.
-              vp run lint || true
-              vp run test:coverage
-          - name: nuxt-devtools
-            node-version: 24
-            # The Windows build can exceed Node's default old-space limit.
-            node-options: --max-old-space-size=4096
-            command: |
-              vp run build
-              vp run typecheck
-              vp run test:unit
-          - name: tiptap
-            node-version: 24
-            command: |
-              vp run build && vp run build:demos
-              vp run lint
-              vp run test:unit
-          - name: 10ten-ja-reader
-            # Match upstream's pin for its locked WebDriverIO/Undici versions.
-            node-version: 24.15.0
-            command: |
-              vp test run --project browser --browser.name=chrome
-          - name: sqlocal
-            node-version: 24
-            command: |
-              # OPFS setup can exceed the upstream 1-second hook timeout on CI.
-              vp test run --browser.name=chrome --hookTimeout=5000
-          - name: brazilian-utils
-            node-version: 24
-            command: |
-              vp test run --browser.enabled --browser.name=chrome --browser.headless
-          - name: solid-vite-plugin
-            node-version: 24
-            # The next branch's Vite 8 example uses Solid 2 and @solidjs/vite-plugin.
-            directory: examples/vite-8
-            command: |
-              # Build the workspace plugin before vp run loads the example configs.
-              (cd ../.. && vp exec rollup -c)
-              vp run build
-              vp run test
-        exclude:
-          # frm-stack uses Docker (testcontainers) which doesn't work the same way on Windows
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: frm-stack
-          # dify only runs on Linux for now
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: dify
-          # vinext uses workerd native deps that don't build on Windows
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: vinext
-          # yaak is a Tauri app with Rust/wasm deps
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: yaak
-          # npmx.dev is a Nuxt app, ubuntu-only for now
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: npmx.dev
-          # varlet upstream CI is ubuntu-only
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: varlet
-          # Codiff's upstream test job is Ubuntu-only and needs native-keymap system libraries.
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: codiff
-          # tiptap upstream CI is ubuntu-only
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: tiptap
-          # Match upstream's Linux Chrome jobs for these WebDriverIO suites.
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: 10ten-ja-reader
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: sqlocal
-          - os: namespace-profile-windows-4c-8g
-            project:
-              name: brazilian-utils
-
-    steps:
-      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: ./.github/actions/clone
-
-      # The project clone only needs the bootstrap Node.js from the clone action.
-      - name: Clone ecosystem project
-        id: ecosystem-project
-        background: true
-        shell: bash
-        run: |
-          git config --global core.autocrlf false
-          node ecosystem-ci/clone.ts "$ECOSYSTEM_PROJECT"
-        env:
-          ECOSYSTEM_PROJECT: ${{ matrix.project.name }}
-
-      # Disable Windows Defender real-time scanning to speed up I/O-heavy operations
-      - name: Disable Windows Defender
-        if: runner.os == 'Windows'
-        continue-on-error: true
-        shell: powershell
-        run: Set-MpPreference -DisableRealtimeMonitoring $true
-
-      - parallel:
-          - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-            with:
-              node-version: ${{ matrix.project.node-version }}
-              package-manager-cache: false
-
-          - name: Download vite-plus packages
-            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-            with:
-              name: vite-plus-packages-${{ matrix.os }}
-              path: tmp/tgz
-
-          - name: Install Codiff native-keymap dependencies
-            if: matrix.project.name == 'codiff'
-            run: |
-              sudo apt-get update
-              sudo apt-get install --yes libx11-dev libxkbfile-dev
-
-      - name: Install vp CLI
-        shell: bash
-        run: |
-          # Place vp binary where install-global-cli.ts expects it (target/release/)
-          mkdir -p target/release
-          cp tmp/tgz/vp target/release/vp 2>/dev/null || cp tmp/tgz/vp.exe target/release/vp.exe 2>/dev/null || true
-          cp tmp/tgz/vp-shim.exe target/release/vp-shim.exe 2>/dev/null || true
-          chmod +x target/release/vp 2>/dev/null || true
-          VP_TGZ=$(ls "$GITHUB_WORKSPACE"/tmp/tgz/vite-plus-[0-9]*.tgz | head -n1)
-          node "$GITHUB_WORKSPACE"/packages/tools/src/install-global-cli.ts --tgz "$VP_TGZ"
-          # Use USERPROFILE (native Windows path) instead of HOME (Git Bash path /c/Users/...)
-          # so cmd.exe and Node.js execSync can resolve binaries in PATH
-          echo "${USERPROFILE:-$HOME}/.vite-plus/bin" >> $GITHUB_PATH
-
-      - wait: ecosystem-project
-
-      - name: Migrate in ${{ matrix.project.name }}
-        working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
-        shell: bash
-        # patch-project.ts starts a local npm registry serving the packed
-        # local build (it stays up for the later steps; the registry env is
-        # exported via GITHUB_ENV), then runs `vp migrate` and the follow-up
-        # `vp install` through it, with pnpm's minimumReleaseAge gate disabled
-        # so freshly published upstream deps install. See its comments.
-        run: node $GITHUB_WORKSPACE/ecosystem-ci/patch-project.ts ${{ matrix.project.name }}
-
-      - name: Verify local packages installed
-        working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
-        shell: bash
-        run: node $GITHUB_WORKSPACE/ecosystem-ci/verify-install.ts
-
-      - name: Determine playwright requirement
-        id: pw
-        shell: bash
-        run: |
-          needs=$(jq -r --arg p '${{ matrix.project.name }}' '.[$p].playwright // false' "$GITHUB_WORKSPACE/ecosystem-ci/repo.json")
-          echo "needs=$needs" >> "$GITHUB_OUTPUT"
-
-      - name: Install Playwright chromium
-        if: steps.pw.outputs.needs == 'true'
-        working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
-        shell: bash
-        run: npx playwright install chromium
-
-      - name: Run vite-plus commands in ${{ matrix.project.name }}
-        working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
-        env:
-          NODE_OPTIONS: ${{ matrix.project.node-options || '' }}
-        run: ${{ matrix.project.command }}
+    uses: ./.github/workflows/reusable-ecosystem-ci.yml
+    with:
+      runner: namespace-profile-windows-4c-8g
+      target: x86_64-pc-windows-msvc
 
   notify-failure:
     name: Notify on failure
     runs-on: ubuntu-latest
-    needs: e2e-test
+    needs: [linux, windows]
     if: ${{ failure() && github.event_name == 'schedule' }}
     permissions:
       contents: read
diff --git a/.github/workflows/reusable-ecosystem-ci.yml b/.github/workflows/reusable-ecosystem-ci.yml
new file mode 100644
index 0000000000..e4db28070a
--- /dev/null
+++ b/.github/workflows/reusable-ecosystem-ci.yml
@@ -0,0 +1,512 @@
+name: Reusable Ecosystem CI
+
+on:
+  workflow_call:
+    inputs:
+      runner:
+        description: Runner for the package build and ecosystem tests.
+        type: string
+        required: true
+      target:
+        description: Rust target for the package build.
+        type: string
+        required: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    name: Build vite-plus packages (${{ inputs.runner }})
+    runs-on: ${{ inputs.runner }}
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      - uses: ./.github/actions/clone
+
+      # Disable Windows Defender real-time scanning to speed up I/O-heavy builds (~30-50% faster)
+      - name: Disable Windows Defender
+        if: runner.os == 'Windows'
+        continue-on-error: true
+        shell: powershell
+        run: Set-MpPreference -DisableRealtimeMonitoring $true
+
+      # Windows builds against the prebuilt binaries from build-windows-cli, so
+      # it needs no Rust toolchain here.
+      - uses: oxc-project/setup-rust@68c3199c5339f965e6e163924c3c450773eba42b # main (pending v1.0.17 — Swatinem/rust-cache v2.9.1 for node24)
+        if: ${{ !contains(inputs.target, 'windows') }}
+        with:
+          save-cache: ${{ github.ref_name == 'main' }}
+          cache-key: e2e-build-${{ inputs.runner }}
+
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
+
+      # Prebuilt by build-windows-cli (Linux + cargo-xwin); placed where
+      # build-upstream's skip-native pass and the pack step expect them.
+      - name: Download prebuilt Windows binaries
+        if: contains(inputs.target, 'windows')
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: windows-cli-binaries
+
+      - name: Build with upstream
+        uses: ./.github/actions/build-upstream
+        with:
+          target: ${{ inputs.target }}
+          skip-native: ${{ contains(inputs.target, 'windows') }}
+
+      - name: Pack packages into tgz
+        env:
+          BUILD_TARGET: ${{ inputs.target }}
+        run: |
+          mkdir -p tmp/tgz
+          # patch-project.ts serves these tgz through a local npm registry
+          # (packages/tools/src/local-npm-registry.ts), so `vp migrate` pins
+          # and installs them like a real release, with every package manager
+          # (including bun) resolving the standard
+          # `vite -> npm:@voidzero-dev/vite-plus-core@<version>` alias. Pin
+          # both packages to 0.0.0 so a correctly installed local build is
+          # always distinguishable from any published version
+          # (verify-install.ts asserts it), even on a release commit that
+          # leaves packages/{core,cli} at a published version.
+          (cd packages/core && npm pkg set version=0.0.0)
+          (cd packages/cli && npm pkg set version=0.0.0)
+          cd packages/core && pnpm pack --pack-destination ../../tmp/tgz && cd ../..
+          cd packages/cli && pnpm pack --pack-destination ../../tmp/tgz && cd ../..
+          # Copy vp binary for e2e-test job (findVpBinary expects it in target/)
+          cp "target/$BUILD_TARGET/release/vp" tmp/tgz/vp 2>/dev/null || cp "target/$BUILD_TARGET/release/vp.exe" tmp/tgz/vp.exe 2>/dev/null || true
+          cp "target/$BUILD_TARGET/release/vp-shim.exe" tmp/tgz/vp-shim.exe 2>/dev/null || true
+          ls -la tmp/tgz
+
+      - name: Upload tgz artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vite-plus-packages-${{ inputs.runner }}
+          path: tmp/tgz/
+          retention-days: 1
+
+  e2e-test:
+    name: ${{ matrix.project.name }} E2E test (${{ matrix.os }})
+    env:
+      # For packing manager install from github package registry
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    permissions:
+      contents: read
+      packages: read
+    needs:
+      - build
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: ${{ matrix.project.timeout || 10 }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ['${{ inputs.runner }}']
+        project:
+          - name: vibe-dashboard
+            node-version: 24
+            command: |
+              # FIXME: Failed to load JS plugin: ./plugins/debugger.js
+              # vp run ready
+              vp fmt
+              # Avoid Windows dynamic port reservations around Vitest's default 63315.
+              vp test --api.port=3000
+              vp run build
+          # FIXME: TypeError: Failed to fetch dynamically imported module
+          # - name: skeleton
+          #   node-version: 24
+          #   command: |
+          #     vp run format
+          #     vp run lint:check
+          #     vp run check
+          #     npx playwright install chromium
+          #     vp run test
+          - name: rollipop
+            node-version: 22
+            command: |
+              vp run -r build
+              # FIXME: typescript-eslint(no-redundant-type-constituents): 'rolldownExperimental.DevEngine' is an 'error' type that acts as 'any' and overrides all other types in this union type.
+              vp run lint || true
+              # FIXME: src/bundler-pool.ts(8,8): error TS2307: Cannot find module '@rollipop/core' or its corresponding type declarations.
+              vp run -r typecheck || true
+              vp run format
+              vp run @rollipop/common#test
+              vp run @rollipop/core#test
+              vp run @rollipop/dev-server#test
+          - name: frm-stack
+            node-version: 24
+            command: |
+              vp run lint:check
+              vp run format:check
+              vp run typecheck
+              vp run @yourcompany/api#test
+              vp run @yourcompany/backend-core#test
+          - name: vue-mini
+            node-version: 24
+            command: |
+              # FIXME: skip format for now, will re-enable after prettier migration support
+              # vp run format
+              # FIXME: oxlint 1.59.0 no-useless-assignment has false positives on module-level
+              # state variables and closure-captured variables (oxc-project/oxc#3022).
+              # The migration sets the rule as "error" in vite.config.ts, so --allow can't override it.
+              vp run lint || true
+              vp run type
+              vp run test -- --coverage
+          # SKIP: vite-plugin-react - vite-task config loading incompatibility
+          # vite-task needs to load vite.config.js for all workspace packages to build the task graph,
+          # but the vite-plus process starts with workspace root as cwd.
+          # The plugin-react-swc playgrounds use SWC plugins (e.g., @swc/plugin-emotion) which
+          # cannot be resolved when loading the config from workspace root.
+          #
+          # Minimal reproduction:
+          #   git clone https://github.com/vitejs/vite-plugin-react /tmp/vite-plugin-react-test
+          #   cd /tmp/vite-plugin-react-test && pnpm install && pnpm run build
+          #   node packages/plugin-react-swc/playground/emotion-plugin/vite.config.js
+          #   # Error: Cannot find module '@swc/plugin-emotion'
+          #
+          # This works when running from within the playground directory (pnpm run build)
+          # because pnpm's symlink structure allows resolution, but fails when loading from workspace root.
+          # - name: vite-plugin-react
+          #   node-version: 22
+          #   command: |
+          #     vp run format
+          #     vp run lint -- --fix
+          #     # TODO(fengmk2): run all builds and tests after tsdown version upgrade
+          #     vp run @vitejs/plugin-rsc#build
+          #     vp run @vitejs/plugin-rsc#test
+          - name: vitepress
+            node-version: 24
+            command: |
+              vp run format
+              vp run build
+              vp test run -r __tests__/unit
+              vp run tests-e2e#test
+              VITE_TEST_BUILD=1 vp run tests-e2e#test
+              vp run tests-init#test
+          - name: tanstack-start-helloworld
+            node-version: 24
+            command: |
+              vp run test
+              vp run build
+          - name: oxlint-plugin-complexity
+            node-version: 22
+            command: |
+              vp run format
+              vp run format:check
+              vp run build
+              vp run lint
+              vp run test:run
+              npx tsc --noEmit
+          - name: decoders
+            node-version: 24
+            command: |
+              vp pack
+              vp test
+          - name: vite-vue-vercel
+            node-version: 24
+            command: |
+              vp run test
+              vp run build
+          - name: dify
+            node-version: 24
+            directory: web
+            # Leave time for tests after migration and the Next.js build.
+            timeout: 20
+            command: |
+              vp run type-check
+              vp run build
+              vp run test real-browser-flicker.test.tsx workflow-onboarding-integration.test.tsx
+          - name: viteplus-ws-repro
+            node-version: 24
+            command: |
+              vp test run
+          - name: vp-config
+            node-version: 22
+            command: |
+              vp check
+              vp pack
+              vp test
+          - name: vinext
+            node-version: 24
+            # The full vinext suite (~7000 tests) outgrew a 15-minute budget
+            # on 4-core runners, so run one shard of the unit project here;
+            # the rest of the suite is covered by vinext's own CI.
+            timeout: 20
+            command: |
+              # vp migrate's auto-install passes --ignore-scripts on pnpm v11
+              # (vinext pins pnpm 11), which skips vinext's approved
+              # better-sqlite3 build, and the follow-up `vp install` never
+              # re-runs it. Rebuild it so the better-auth fixture works.
+              vp rebuild -- -r better-sqlite3
+              vp run build
+              vp check --fix
+              vp run check
+              vp test run --project unit --shard=1/3
+          - name: videojs-v10
+            node-version: 24
+            command: |
+              node $GITHUB_WORKSPACE/ecosystem-ci/verify-videojs-v10.ts
+              # The upstream preset keeps existing diagnostics at warning level.
+              vp lint --quiet
+              vp test run tools/oxlint/anti-slop/rules/tests
+          - name: reactive-resume
+            node-version: 24
+            command: |
+              vp fmt
+              vp lint --type-aware
+              vp build
+              vp test
+          - name: yaak
+            node-version: 24
+            command: |
+              vp fmt
+              # FIXME: type-aware lint fails with "Invalid tsconfig" without full Rust/wasm bootstrap
+              vp lint || true
+              vp test
+          - name: npmx.dev
+            node-version: 24
+            command: |
+              vp fmt
+              vp run lint
+              vp run test:types
+              vp test --project nuxt
+              vp test --project unit
+          - name: codiff
+            node-version: 24
+            timeout: 20
+            command: |
+              # Codiff uses pnpm's default 24-hour release age. Allow newly
+              # published toolchain packages in this ecosystem run.
+              export pnpm_config_minimum_release_age=0
+              export PNPM_CONFIG_MINIMUM_RELEASE_AGE=0
+              # Migration skips install scripts. node-pty has no Linux prebuild,
+              # so build its approved native addon before running the tests.
+              vp pm rebuild node-pty
+              vp run build
+              # The separate Workers integration suite still requires Vitest 4.
+              vp test run
+          - name: vite-plus-jest-dom-repro
+            node-version: 24
+            command: |
+              vp test run
+          - name: bun-vite-template
+            node-version: 24
+            command: |
+              # FIXME: mantine uses postcss-simple-vars (e.g. `@media (max-width:
+              # $mantine-breakpoint-md)` in src/components/Welcome/Welcome.module.css),
+              # which oxfmt's CSS parser does not support yet (regressed in oxfmt 0.57.0
+              # after the switch to oxc-css-parser). Tracking issue:
+              # https://github.com/oxc-project/oxc/issues/23969. Drop the `|| true`
+              # once postcss-simple-vars syntax is supported.
+              vp fmt || true
+              vp run validate
+          - name: vite-plus-vitest-global-type-minimal-repro
+            node-version: 24
+            command: |
+              vp test
+              vp check --fix
+          - name: vitest-playwright-repro
+            node-version: 24
+            command: |
+              vp test
+          - name: vite-plus-vitest-type-aug
+            node-version: 24
+            command: |
+              vp check --fix
+          - name: vite-plus-monorepo-overrides
+            node-version: 24
+            command: |
+              vp check --fix
+              vp run verify
+          - name: varlet
+            node-version: 22
+            command: |
+              node scripts/bootstrap.mjs
+              # Report-only: oxlint 1.68.0 surfaces ts1038 ("A 'declare' modifier
+              # cannot be used in an already ambient context.") on varlet's
+              # packages/varlet-cli/src/module.d.ts, which carries a redundant
+              # `declare` inside an ambient `declare module 'jest'` block. varlet can
+              # only drop the redundant modifier upstream once a vite-plus release
+              # ships oxlint 1.68.0, so don't fail the matrix on it yet. Follow-up:
+              # submit a fix PR to varletjs/varlet after the next vite-plus release.
+              vp run lint || true
+              vp run test:coverage
+          - name: nuxt-devtools
+            node-version: 24
+            # The Windows build can exceed Node's default old-space limit.
+            node-options: --max-old-space-size=4096
+            command: |
+              vp run build
+              vp run typecheck
+              vp run test:unit
+          - name: tiptap
+            node-version: 24
+            command: |
+              vp run build && vp run build:demos
+              vp run lint
+              vp run test:unit
+          - name: 10ten-ja-reader
+            # Match upstream's pin for its locked WebDriverIO/Undici versions.
+            node-version: 24.15.0
+            command: |
+              vp test run --project browser --browser.name=chrome
+          - name: sqlocal
+            node-version: 24
+            command: |
+              # OPFS setup can exceed the upstream 1-second hook timeout on CI.
+              vp test run --browser.name=chrome --hookTimeout=5000
+          - name: brazilian-utils
+            node-version: 24
+            command: |
+              vp test run --browser.enabled --browser.name=chrome --browser.headless
+          - name: solid-vite-plugin
+            node-version: 24
+            # The next branch's Vite 8 example uses Solid 2 and @solidjs/vite-plugin.
+            directory: examples/vite-8
+            command: |
+              # Build the workspace plugin before vp run loads the example configs.
+              (cd ../.. && vp exec rollup -c)
+              vp run build
+              vp run test
+        exclude:
+          # frm-stack uses Docker (testcontainers) which doesn't work the same way on Windows
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: frm-stack
+          # dify only runs on Linux for now
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: dify
+          # vinext uses workerd native deps that don't build on Windows
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: vinext
+          # yaak is a Tauri app with Rust/wasm deps
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: yaak
+          # npmx.dev is a Nuxt app, ubuntu-only for now
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: npmx.dev
+          # varlet upstream CI is ubuntu-only
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: varlet
+          # Codiff's upstream test job is Ubuntu-only and needs native-keymap system libraries.
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: codiff
+          # tiptap upstream CI is ubuntu-only
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: tiptap
+          # Match upstream's Linux Chrome jobs for these WebDriverIO suites.
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: 10ten-ja-reader
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: sqlocal
+          - os: namespace-profile-windows-4c-8g
+            project:
+              name: brazilian-utils
+
+    steps:
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      - uses: ./.github/actions/clone
+
+      # The project clone only needs the bootstrap Node.js from the clone action.
+      - name: Clone ecosystem project
+        id: ecosystem-project
+        background: true
+        shell: bash
+        run: |
+          git config --global core.autocrlf false
+          node ecosystem-ci/clone.ts "$ECOSYSTEM_PROJECT"
+        env:
+          ECOSYSTEM_PROJECT: ${{ matrix.project.name }}
+
+      # Disable Windows Defender real-time scanning to speed up I/O-heavy operations
+      - name: Disable Windows Defender
+        if: runner.os == 'Windows'
+        continue-on-error: true
+        shell: powershell
+        run: Set-MpPreference -DisableRealtimeMonitoring $true
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.project.node-version }}
+          package-manager-cache: false
+
+      - name: Download vite-plus packages
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vite-plus-packages-${{ matrix.os }}
+          path: tmp/tgz
+
+      - name: Install Codiff native-keymap dependencies
+        if: matrix.project.name == 'codiff'
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes libx11-dev libxkbfile-dev
+
+      - name: Install vp CLI
+        shell: bash
+        run: |
+          # Place vp binary where install-global-cli.ts expects it (target/release/)
+          mkdir -p target/release
+          cp tmp/tgz/vp target/release/vp 2>/dev/null || cp tmp/tgz/vp.exe target/release/vp.exe 2>/dev/null || true
+          cp tmp/tgz/vp-shim.exe target/release/vp-shim.exe 2>/dev/null || true
+          chmod +x target/release/vp 2>/dev/null || true
+          VP_TGZ=$(ls "$GITHUB_WORKSPACE"/tmp/tgz/vite-plus-[0-9]*.tgz | head -n1)
+          node "$GITHUB_WORKSPACE"/packages/tools/src/install-global-cli.ts --tgz "$VP_TGZ"
+          # Use USERPROFILE (native Windows path) instead of HOME (Git Bash path /c/Users/...)
+          # so cmd.exe and Node.js execSync can resolve binaries in PATH
+          echo "${USERPROFILE:-$HOME}/.vite-plus/bin" >> $GITHUB_PATH
+
+      - wait: ecosystem-project
+
+      - name: Migrate in ${{ matrix.project.name }}
+        working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
+        shell: bash
+        # patch-project.ts starts a local npm registry serving the packed
+        # local build (it stays up for the later steps; the registry env is
+        # exported via GITHUB_ENV), then runs `vp migrate` and the follow-up
+        # `vp install` through it, with pnpm's minimumReleaseAge gate disabled
+        # so freshly published upstream deps install. See its comments.
+        run: node $GITHUB_WORKSPACE/ecosystem-ci/patch-project.ts ${{ matrix.project.name }}
+
+      - name: Verify local packages installed
+        working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
+        shell: bash
+        run: node $GITHUB_WORKSPACE/ecosystem-ci/verify-install.ts
+
+      - name: Determine playwright requirement
+        id: pw
+        shell: bash
+        run: |
+          needs=$(jq -r --arg p '${{ matrix.project.name }}' '.[$p].playwright // false' "$GITHUB_WORKSPACE/ecosystem-ci/repo.json")
+          echo "needs=$needs" >> "$GITHUB_OUTPUT"
+
+      - name: Install Playwright chromium
+        if: steps.pw.outputs.needs == 'true'
+        working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
+        shell: bash
+        run: npx playwright install chromium
+
+      - name: Run vite-plus commands in ${{ matrix.project.name }}
+        working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
+        env:
+          NODE_OPTIONS: ${{ matrix.project.node-options || '' }}
+        run: ${{ matrix.project.command }}
diff --git a/.github/workflows/reusable-release-build.yml b/.github/workflows/reusable-release-build.yml
index 46a1cf678b..1b6520acfb 100644
--- a/.github/workflows/reusable-release-build.yml
+++ b/.github/workflows/reusable-release-build.yml
@@ -59,11 +59,10 @@ jobs:
           save-cache: ${{ github.ref_name == 'main' }}
           cache-key: ${{ inputs.cache-key }}
 
-      - parallel:
-          - name: Rustup Adds Target
-            run: rustup target add ${{ matrix.settings.target }}
+      - name: Rustup Adds Target
+        run: rustup target add ${{ matrix.settings.target }}
 
-          - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
+      - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
       - name: Set build version
         shell: bash
@@ -119,8 +118,6 @@ jobs:
           target: ${{ matrix.settings.target }}
 
       - name: Upload Vite+ native artifact
-        id: native-upload
-        background: true
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vite-plus-native-${{ matrix.settings.target }}
@@ -128,8 +125,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload Rust CLI binary artifact
-        id: cli-upload
-        background: true
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vp-global-cli-${{ matrix.settings.target }}
@@ -194,8 +189,6 @@ jobs:
           ' "${archive_dir}/plan.json" "${VERSION}"
 
       - name: Upload release archive
-        id: archive-upload
-        background: true
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vp-release-archive-${{ matrix.settings.target }}
@@ -205,8 +198,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload installer binary artifact (Windows only)
-        id: installer-upload
-        background: true
         if: contains(matrix.settings.target, 'windows')
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -219,47 +210,44 @@ jobs:
         run: |
           rm ./packages/core/dist/**/*.node
 
-      - parallel:
-          - name: Upload core dist
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-            with:
-              name: core
-              path: ./packages/core/dist
-              if-no-files-found: error
-
-          - name: Upload prompts dist
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-            with:
-              name: prompts
-              path: ./packages/prompts/dist
-              if-no-files-found: error
+      - name: Upload core dist
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+        with:
+          name: core
+          path: ./packages/core/dist
+          if-no-files-found: error
 
-          - name: Upload cli dist
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-            with:
-              name: cli
-              path: ./packages/cli/dist
-              if-no-files-found: error
+      - name: Upload prompts dist
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+        with:
+          name: prompts
+          path: ./packages/prompts/dist
+          if-no-files-found: error
 
-          - name: Upload cli docs
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-            with:
-              name: cli-docs
-              path: ./packages/cli/docs
-              if-no-files-found: error
+      - name: Upload cli dist
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+        with:
+          name: cli
+          path: ./packages/cli/dist
+          if-no-files-found: error
 
-          - name: Upload LICENSE files
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-            if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
-            with:
-              name: licenses
-              path: |
-                ./packages/core/LICENSE
-                ./packages/cli/LICENSE
-              if-no-files-found: error
+      - name: Upload cli docs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+        with:
+          name: cli-docs
+          path: ./packages/cli/docs
+          if-no-files-found: error
 
-      - wait: [native-upload, cli-upload, archive-upload, installer-upload]
+      - name: Upload LICENSE files
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }}
+        with:
+          name: licenses
+          path: |
+            ./packages/core/LICENSE
+            ./packages/cli/LICENSE
+          if-no-files-found: error

From 94712a24c0e23fec63710dda40fcc22d50d67f41 Mon Sep 17 00:00:00 2001
From: MK <fengmk2@gmail.com>
Date: Sat, 10 Oct 2026 20:31:40 +0800
Subject: [PATCH 4/5] fix(ci): restore Cargo cache ownership after container
 builds

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aaff7973c7..b678c0dcb6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1425,6 +1425,10 @@ jobs:
               cargo build -p vp_global_cli
             '
 
+      # Docker creates files as root. The host cache action must read and clean them.
+      - name: Restore Cargo cache ownership
+        run: sudo chown -R "$(id -u):$(id -g)" "$HOME/.cargo/registry" "$HOME/.cargo/git" target
+
       - name: Run vp in node:24-bookworm-slim without a CA store
         run: |
           docker run --rm \

From a8691f1d2f5a0a2aa9ea3f0e2711941386c878ea Mon Sep 17 00:00:00 2001
From: MK <fengmk2@gmail.com>
Date: Sat, 10 Oct 2026 23:44:50 +0800
Subject: [PATCH 5/5] refactor(ci): simplify workflow shell setup

---
 .github/workflows/ci.yml                    | 30 +++++++--------------
 .github/workflows/reusable-ecosystem-ci.yml |  6 -----
 2 files changed, 10 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b678c0dcb6..96792c2c91 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1042,25 +1042,17 @@ jobs:
         id: snapshot-shells
         background: true
         run: |
-          if ! command -v fish >/dev/null 2>&1; then
-            if [ "$RUNNER_OS" = 'Linux' ]; then
-              sudo apt-get update
-              sudo apt-get install --yes fish
-            else
-              brew install fish
+          for snapshot_shell in fish zsh; do
+            if ! command -v "$snapshot_shell" >/dev/null 2>&1; then
+              if [ "$RUNNER_OS" = 'Linux' ]; then
+                sudo apt-get update
+                sudo apt-get install --yes "$snapshot_shell"
+              else
+                brew install "$snapshot_shell"
+              fi
             fi
-          fi
-          fish --version
-
-          if ! command -v zsh >/dev/null 2>&1; then
-            if [ "$RUNNER_OS" = 'Linux' ]; then
-              sudo apt-get update
-              sudo apt-get install --yes zsh
-            else
-              brew install zsh
-            fi
-          fi
-          zsh --version
+            "$snapshot_shell" --version
+          done
 
       # https://github.com/marketplace/actions/setup-nu
       - name: Install Nushell
@@ -1205,7 +1197,6 @@ jobs:
       - name: Install Playwright Chromium
         id: playwright
         background: true
-        shell: bash
         run: pnpm exec playwright install chromium
         env:
           PLAYWRIGHT_BROWSERS_PATH: '0'
@@ -1573,7 +1564,6 @@ jobs:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       - uses: ./.github/actions/clone
 
-      # Reuse the platform build instead of compiling the same native code again.
       - uses: oxc-project/setup-node@1f1a5b4450c8905bd1830c3a908d22b960c4559a # main (Node before pnpm; unreleased)
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/reusable-ecosystem-ci.yml b/.github/workflows/reusable-ecosystem-ci.yml
index e4db28070a..16d3096a34 100644
--- a/.github/workflows/reusable-ecosystem-ci.yml
+++ b/.github/workflows/reusable-ecosystem-ci.yml
@@ -430,7 +430,6 @@ jobs:
       - name: Clone ecosystem project
         id: ecosystem-project
         background: true
-        shell: bash
         run: |
           git config --global core.autocrlf false
           node ecosystem-ci/clone.ts "$ECOSYSTEM_PROJECT"
@@ -462,7 +461,6 @@ jobs:
           sudo apt-get install --yes libx11-dev libxkbfile-dev
 
       - name: Install vp CLI
-        shell: bash
         run: |
           # Place vp binary where install-global-cli.ts expects it (target/release/)
           mkdir -p target/release
@@ -479,7 +477,6 @@ jobs:
 
       - name: Migrate in ${{ matrix.project.name }}
         working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
-        shell: bash
         # patch-project.ts starts a local npm registry serving the packed
         # local build (it stays up for the later steps; the registry env is
         # exported via GITHUB_ENV), then runs `vp migrate` and the follow-up
@@ -489,12 +486,10 @@ jobs:
 
       - name: Verify local packages installed
         working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
-        shell: bash
         run: node $GITHUB_WORKSPACE/ecosystem-ci/verify-install.ts
 
       - name: Determine playwright requirement
         id: pw
-        shell: bash
         run: |
           needs=$(jq -r --arg p '${{ matrix.project.name }}' '.[$p].playwright // false' "$GITHUB_WORKSPACE/ecosystem-ci/repo.json")
           echo "needs=$needs" >> "$GITHUB_OUTPUT"
@@ -502,7 +497,6 @@ jobs:
       - name: Install Playwright chromium
         if: steps.pw.outputs.needs == 'true'
         working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}
-        shell: bash
         run: npx playwright install chromium
 
       - name: Run vite-plus commands in ${{ matrix.project.name }}