[ci-speed] [no preview] deploy: is the sync worker bundle reproducible across commits

.github/ci-speed/sync_bundle.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Builds and bundles the worker with wrangler's dry run, then hashes what would upload.
+# No Cloudflare token exists in this job, so nothing can reach Cloudflare's write API.
+set -euo pipefail
+key=$(bash harness/.github/ci-speed/sync_key.sh)
+cd services/sync-service
+if [ -n "${CLOUDFLARE_API_TOKEN:-}" ]; then echo "refusing: token present"; exit 9; fi
+start=$(date +%s)
+npm ci --silent
+mid=$(date +%s)
+npx wrangler deploy --dry-run --env dev --outdir "$RUNNER_TEMP/out"
+end=$(date +%s)
+bundle=$(\cd "$RUNNER_TEMP/out" && find . -type f -print0 | LC_ALL=C sort -z | xargs -0 sha256sum | sha256sum | cut -d' ' -f1)
+config=$(cat wrangler.toml package-lock.json | sha256sum | cut -d' ' -f1)
+migr=$(git ls-tree -r HEAD database | sha256sum | cut -d' ' -f1)
+(cd "$RUNNER_TEMP/out" && find . -type f -exec sha256sum {} + | sed -E "s/^(.{12})[^ ]* +/FILE \1 /" | LC_ALL=C sort -k3)
+echo "RESULT key=${key:0:16} sha=$(git rev-parse --short=12 HEAD) label=$LABEL attempt=$ATTEMPT npm_s=$((mid-start)) bundle_s=$((end-mid)) bundle=${bundle:0:16} config=${config:0:12} migrations=${migr:0:12} files=$(find "$RUNNER_TEMP/out" -type f | wc -l)" | tee -a "$GITHUB_STEP_SUMMARY"

.github/ci-speed/sync_key.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Prints a key that changes whenever an input to the sync worker's deployed bundle changes.
+# Run from the repository root.
+set -euo pipefail
+{
+  # The worker's workspace closure, including its wrangler config, lockfile and migrations.
+  jq -r '.closures.sync_service[]' .github/workspace-dep-closures.json | LC_ALL=C sort | while read -r dir; do
+    printf '%s %s\n' "$dir" "$(git rev-parse "HEAD:$dir")"
+  done
+  # Third-party crates exactly as the worker resolves them, so unrelated Cargo.lock changes don't count.
+  cargo tree --locked -p sync_service --target wasm32-unknown-unknown -e normal,build -f '{p} {f}' --prefix none | LC_ALL=C sort -u
+  # Build settings that live outside the closure.
+  for path in rust-toolchain.toml .cargo/config.toml vendor; do
+    if git cat-file -e "HEAD:$path" 2>/dev/null; then printf '%s %s\n' "$path" "$(git rev-parse "HEAD:$path")"; fi
+  done
+  python3 -I -c 'import tomllib; d = tomllib.load(open("Cargo.toml", "rb")); print(sorted(d.get("profile", {}).items())); print(sorted(d.get("patch", {}).items()))'
+} | sed -E 's#\(/[^)]*/(macro|src)/#(#' | sha256sum | cut -d' ' -f1

.github/workflows/ci_speed_sync_bundle.yml

@@ -0,0 +1,48 @@
+# Experiment only: wrangler dry run, no Cloudflare secret in the job, so it cannot deploy.
+name: ci-speed sync bundle
+on:
+  pull_request:
+    paths: ['.github/ci-speed/**', '.github/workflows/ci_speed_sync_bundle.yml']
+permissions: { contents: read }
+jobs:
+  bundle:
+    name: ${{ matrix.label }} ${{ matrix.attempt }} ${{ matrix.sha }}
+    runs-on: namespace-profile-linux-mid;overrides.cache-tag=ci-speed-sync-bench
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        include:
+          - { label: warmup, sha: 240bc4d6a32425efaedbb633b7eafd52848e8461, attempt: 0 }
+          - { label: same-worker, sha: 240bc4d6a32425efaedbb633b7eafd52848e8461, attempt: 1 }
+          - { label: same-worker, sha: 240bc4d6a32425efaedbb633b7eafd52848e8461, attempt: 2 }
+          - { label: lock-changed, sha: 5a4d56aa13bee9cb55d948e86d906cc8f09181c6, attempt: 1 }
+          - { label: none-changed, sha: ce7984a95c8cfcefe1d00040cc25c2c90536ca11, attempt: 1 }
+          - { label: lock-toml-changed, sha: 45d9102dd4d95c54608f02c27810f765a4854c55, attempt: 1 }
+          - { label: lock-toml-changed, sha: 1b51727cad9570c734a7eafe64475999c0bacedd, attempt: 1 }
+          - { label: lock-changed, sha: a701da266b9262645eadd65101a745c7f42f4f3d, attempt: 1 }
+          - { label: worker-changed-before, sha: 25f6d1b653145575ce3324da3f9beb41aa99179d, attempt: 1 }
+          - { label: same-worker-3, sha: 240bc4d6a32425efaedbb633b7eafd52848e8461, attempt: 3 }
+          - { label: worker-changed-after, sha: 70831cf4d554c40fecfa5c816e86c339ffdfeca9, attempt: 1 }
+    env: { LABEL: "${{ matrix.label }}", ATTEMPT: "${{ matrix.attempt }}" }
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with: { persist-credentials: false, clean: false, ref: "${{ matrix.sha }}" }
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with: { persist-credentials: false, path: harness }
+      - uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0
+        with:
+          cache: rust
+          path: |-
+            ${{ github.workspace }}/target
+            /home/runner/.cargo/bin
+            /home/runner/.cache/.wasm-pack
+        continue-on-error: true
+      - uses: ./.github/actions/setup-rust
+        with: { sccache: 'false', rust-cache: 'false' }
+      - run: rustup target add wasm32-unknown-unknown
+      - uses: actions/setup-node@v4
+        with: { node-version: '22' }
+      - run: bash harness/.github/ci-speed/sync_bundle.sh
+        env: { RUNNER_TEMP_NOTE: key }