improvement(ci): parallelize Docker builds and fix test timeouts

[waleedlatif1]

Summary

• Parallelize Docker builds with test-build by removing test-build from needs on build-amd64 and build-ghcr-arm64 jobs — code reaching main/staging has already been PR-tested
• Remove duplicate bun install -g turbo in app.Dockerfile deps stage (only needed in builder stage)
• Mock secureFetchWithPinnedIP and validateUrlWithDNS in tools/index.test.ts to fix two tests timing out in CI

Type of Change

• Maintenance/chore
• Bug fix (test timeouts)

Testing

• All 66 tests in tools/index.test.ts pass locally
• CI optimizations are structural (dependency graph changes)

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 9, 2026 9:53pm

[cursor]

PR Summary

Medium Risk
Changes the CI job dependency graph so Docker images can build/push without waiting for test-build, which could publish artifacts from main/staging/dev even if tests fail. The rest is low-risk build/test scaffolding adjustments (Docker layer optimization and more complete fetch mocks).

Overview
Speeds up CI by decoupling Docker image build/push jobs from test-build, letting build-amd64 and build-ghcr-arm64 run as soon as detect-version completes (i.e., in parallel with tests).

Optimizes the docker/app.Dockerfile deps stage by removing the redundant bun install -g turbo (keeping the global turbo install only in the builder stage), improving cacheability and build time.

Fixes flaky/timeouting unit tests by updating apps/sim/tools/index.test.ts to mock secureFetchWithPinnedIP with a Response-like object (including headers/text/json behavior) alongside DNS validation mocking.

^{Reviewed by Cursor Bugbot for commit 1d3e9d9. Configure here.}

[greptile-apps]

Greptile Summary

This PR makes three targeted CI/infra improvements: decouples the Docker build jobs from test-build in the needs chain (so builds and tests run in parallel), removes a redundant bun install -g turbo from the deps stage in app.Dockerfile, and mocks secureFetchWithPinnedIP/validateUrlWithDNS in tools/index.test.ts to prevent real DNS/network calls from timing out in CI. The intentional tradeoff of running builds and tests concurrently was already reviewed and accepted.

Confidence Score: 5/5

Safe to merge — all findings are minor style/completeness suggestions with no impact on CI correctness or production behavior.

The CI parallelization was intentionally reviewed and accepted, the Dockerfile cleanup is straightforward, and the test mock fix resolves real CI timeouts. The only remaining notes are a missing arrayBuffer stub and a stale comment — both P2 and non-blocking.

apps/sim/tools/index.test.ts — minor mock completeness issue.

Vulnerabilities

No security concerns identified. The new mocks are test-only and do not affect production code paths.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Removed test-build from needs on build-amd64 and build-ghcr-arm64, letting Docker builds run in parallel with tests; the tradeoff was reviewed and accepted as intentional.
docker/app.Dockerfile	Removed duplicate bun install -g turbo from the deps stage; turbo is only needed in the builder stage where it is still present.
apps/sim/tools/index.test.ts	Added vi.hoisted + vi.mock for input-validation.server to intercept SSRF-protection calls; mock shape is missing arrayBuffer from SecureFetchResponse, and one test comment is now stale.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    push[Push to main/staging/dev] --> test-build[test-build]
    push --> detect-version[detect-version]

    detect-version --> build-amd64[build-amd64\n3 matrix jobs]
    detect-version --> build-ghcr-arm64[build-ghcr-arm64\n3 matrix jobs]

    test-build -. runs in parallel .-> build-amd64
    test-build -. runs in parallel .-> build-ghcr-arm64

    build-amd64 --> create-ghcr-manifests[create-ghcr-manifests]
    build-ghcr-arm64 --> create-ghcr-manifests

    create-ghcr-manifests --> create-release[create-release\nversion commits only]
    build-amd64 --> process-docs[process-docs\ndocs changes only]

    style test-build fill:#f9f,stroke:#333
    style build-amd64 fill:#bbf,stroke:#333
    style build-ghcr-arm64 fill:#bbf,stroke:#333

Loading

_{Reviews (2): Last reviewed commit: "fix(test): use SecureFetchResponse shape..." | Re-trigger Greptile}

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1d3e9d9. Configure here.}

[greptile-apps]

Greptile encountered an error while reviewing this PR. Please reach out to support@greptile.com for assistance.