perf(workflow): parallelise jobs

[mulahasanovic]

Issue

Slow workflow.

Intent

Speed up the workflow execution.

Implementation

Parallelise the jobs.

Checks

• Code is formatted correctly (npm run lint:fix).
• Any new functionality has been unit tested.
• All unit tests are passing (npm test).
• Unit tests coverage has been increased and a new threshold is set.
• All CI checks are green.
• Development comments have been added or updated.
• Development documentation coverage has been increased and a new threshold is set.
• Reviewer is assigned.

Reviewer checks

• Any new code is documented.

[github-actions]

Coverage report

Caution

Multiple errors occurred

 1 | Error: The process '/opt/hostedtoolcache/node/20.20.1/x64/bin/npx' failed with exit code 1
 2 | Coverage output file not found. (file "report.json" not found)
 3 | Getting code coverage data failed.

St.❔	Category	Percentage	Covered / Total
🟡	Statements	73.62%	3319/4508
🟡	Branches	60.65%	1321/2178
🟡	Functions	73.63%	673/914
🟡	Lines	74.22%	3227/4348

Report generated by 🧪jest coverage report action from eef34da

[github-actions]

Coverage report

Total coverage

Status	Category	Percentage	Covered / Total
🟡	Statements	73.65%	3320/4508
🟡	Branches	60.61%	1320/2178
🟡	Functions	73.74%	674/914
🟢	Lines	82.86%	8463/10213

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Report generated by 🧪jest coverage report action from 499f53c

[4gl-reviewer]

Hermes Agent Code Review

Verdict: Comment

This PR splits the monolithic test job in run-tests.yml into 6 parallel jobs (lint, audit, docs, build-and-smoke, unit-tests, server-tests), upgrades all actions to v4, expands the Linux matrix to Node 22 + 24, and modernises the Windows and publish workflows. The parallelisation is well-structured — each job is self-contained with its own checkout/setup/install, so there is no shared-state risk between parallel runners.

⚠️ Mergeability note: GitHub reports this PR as mergeable: false / mergeable_state: dirty — there are merge conflicts with main that need to be resolved before merging. All 13 CI check runs on the head SHA pass with success.

Warnings

1. Missing permissions block — The original test job declared explicit permissions (contents: read, checks: write, pull-requests: write, issues: write). None of the new split jobs declare permissions, so they fall back to repo defaults. The unit-tests job uses jest-coverage-report-action with GITHUB_TOKEN, which needs checks: write and pull-requests: write to post coverage reports. CI is green today (repo defaults are permissive), but if the repo default is ever tightened to read (GitHub's recommendation), the coverage action will silently break. Recommend adding least-privilege permissions to unit-tests at minimum.

2. npm audit step-order change — In the original, npm audit ran before the production install. Now the order is swapped: npm ci --omit=dev runs first, then npm audit. Since npm audit reads the lockfile and doesn't need node_modules, the original order served as a fast pre-check. With the new order, a production-install failure hides audit results. Minor, but worth noting.

3. testPathIgnorePatterns broadness — Adding test-app-create- and test-app-init- is a good fix to prevent Jest from discovering spec files inside generated app directories. These are regexes matched against the full test path; bare substrings without / delimiters could theoretically match unintended paths. Anchoring with a leading / (e.g. /test-app-create-) would be more precise.

Suggestions

4. Node version inconsistency — run-tests.yml hardcodes [22, 24] while run-tests-windows.yml and npmpublish.yml use the lts/jod alias. If the intent is to test across multiple majors (22 + 24), a comment explaining why literals are used here vs. the alias elsewhere would help future maintainers.

5. Windows lint removal — The Check code style step was removed from run-tests-windows.yml. This is fine since lint now runs as a dedicated parallel job on Linux, but Windows-specific lint issues (e.g., CRLF line endings) will no longer be caught. Likely acceptable.

6. Redundant registry step in npmpublish.yml — Set NPM Registry back to https sets https://registry.npmjs.org, which is the same value already set in the Install dependencies step. This appears pre-existing but could be cleaned up.

Looks Good

• ✅ Clean job separation — each parallel job is fully self-contained (checkout → setup-node → npm ci → task), no implicit dependencies between jobs.
• ✅ Action version upgrades: checkout@v2 → v4, setup-node@v3 → v4 (addresses deprecated Node 12/16 runners).
• ✅ npm i -g pm2 → npx pm2 in server-tests — avoids unnecessary global installs.
• ✅ Removing http://registry.npmjs.org in favour of the default https:// — better security.
• ✅ env.NODE_VERSION: lts/jod in Windows/publish workflows — clean single-source version pinning.
• ✅ Combining unzip + pm2 start into a single step — reduces step overhead.
• ✅ No secrets leaked, no injection vectors, no unsafe inputs in workflow run steps.

Reviewed by Hermes Agent (GitHub App)

[4gl-reviewer]

The unit-tests job uses jest-coverage-report-action with GITHUB_TOKEN to post coverage reports. The original job had an explicit permissions block (checks: write, pull-requests: write); this job has none. Consider adding least-privilege permissions here so the coverage action keeps working if repo defaults are ever tightened.

[4gl-reviewer]

Behaviour change: npm audit now runs after npm ci --omit=dev instead of before. npm audit reads the lockfile and doesn't need node_modules, so the original order was a faster pre-check. If the production install fails here, audit results are lost.

[4gl-reviewer]

Node versions hardcoded as [22, 24] here, while run-tests-windows.yml and npmpublish.yml use lts/jod. If the intent is to test across two major versions, a brief comment would help future maintainers understand why this matrix differs from the alias-based approach elsewhere.

[4gl-reviewer]

Good fix to prevent Jest from picking up spec files inside generated test-app-create-* / test-app-init-* directories. These are regexes against the full test path — consider anchoring with a leading / (e.g. /test-app-create-) for precision.