chore(ci): run independent steps in parallel to cut CI time - #66300

Problem

GitHub Actions now supports running steps in parallel within a single job (parallel / background / wait / wait-all / cancel). Many of our jobs run a long chain of independent setup steps sequentially — install Python, then uv, then rust, then pnpm, then download a database — when most of these are network-bound and have no dependency on each other. This is wasted wall-clock time on the critical path of nearly every PR.

Changes

Adopt step-level parallelism to overlap genuinely-independent work inside single jobs. 16 parallel groups plus one background/wait pattern across 9 workflows:

In every group, steps with a real data dependency stay sequential after the block — sqlx-cli needs cargo, SAML needs uv's cache-hit output, python deps need python+uv, rust service builds need the toolchain. No two apt steps ever share a group (dpkg lock). Every group is ≤7 steps, under the 10-concurrent limit.

The pinned actionlint (v1.7.12) predates this feature, so it would flag the new step keys as unexpected. ci-actionlint.yml gets scoped -ignore patterns for just those keys until a supporting version is pinned.

How did you test this code?

I'm an agent (Claude Code). I did not run these workflows on real runners — that's what this PR's own CI run will exercise. What I verified locally:

• All 9 edited workflows parse as YAML.
• Each transformed block matches the documented schema (a step with a parallel: list of step dicts; background: true + id + wait:).
• Ran the repo's own workflow-model parser (tools/hogli-commands/.../workflow_lint) over all 95 workflows — no parse errors; it sees every new group.
• pnpm exec oxfmt --check "**/*.{yaml,yml}" passes, so the YAML-format gate stays green.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Authored with Claude Code (session) at @gantoine's direction, in response to the parallel-steps changelog. No repo skills were invoked — this is workflow YAML only.

Key decisions:

• Tier 1 (background services) was deliberately not forced. The Playwright stack is already hand-overlapped (browser install runs during server warmup), and Storybook's serve step has restart-on-death retry logic that wait can't replicate. Converting never-exiting servers to background: is also a footgun: the implicit end-of-job wait-all would hang on them unless each is cancelled. The background/wait primitive is used only where it genuinely helps — ci-rust linting.
• Down-weighted optimistic time estimates. Most setup steps are CPU/network-bound on a single runner, so they don't scale linearly. clippy+check and ty+mypy were kept sequential to avoid doubling peak memory (OOM risk).
• Conservative on the flagship django job given its blast radius — kept the token→Python pair and the apt steps sequential, grouping only the clearly-independent installs.

Reviewer watch-items: (1) the first real run validates that the new syntax is accepted on our Depot/GitHub runners; (2) the actionlint -ignore regex is a best guess since the docs host was unreachable from the agent environment — if that job goes red, refine the regex or bump ACTIONLINT_VERSION.

🤖 Generated with Claude Code

https://claude.ai/code/session_016naK9Bwh7TtH5KcmKAYzzS

Generated by Claude Code