chore(ci): parallelize independent workflow tasks

.depot/workflows/ci-backend.yml

@@ -828,15 +828,21 @@ jobs:
             # Shadow trial: canonical threads a setup-action app token into both
             # pnpm-install and setup-python; mint stripped here (secret not
             # available on Depot), so setup-python keeps the bot PAT.
-            - name: Install pnpm dependencies
-              uses: ./.depot/actions/pnpm-install
-              with:
-                  install-command: pnpm install --frozen-lockfile --filter=@posthog/root
-            - name: Set up Python
-              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-              with:
-                  python-version: 3.13.13
-                  token: ${{ secrets.POSTHOG_BOT_PAT }}
+            - parallel:
+                  - name: Install pnpm dependencies
+                    uses: ./.depot/actions/pnpm-install
+                    with:
+                        install-command: pnpm install --frozen-lockfile --filter=@posthog/root
+                  - name: Set up Python
+                    uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+                    with:
+                        python-version: 3.13.13
+                        token: ${{ secrets.POSTHOG_BOT_PAT }}
+                  - name: Install Rust
+                    uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+                    with:
+                        toolchain: 1.91.1
+                        components: cargo
             - name: Install uv
               id: setup-uv
               uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
@@ -848,11 +854,6 @@ jobs:
             - name: Install SAML dependencies
               if: steps.setup-uv.outputs.cache-hit != 'true'
               run: sudo rm -f /etc/apt/sources.list.d/*twingate* && sudo apt-get update && sudo apt-get install -y libxml2-dev libxmlsec1-dev libxmlsec1-openssl
-            - name: Install Rust
-              uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
-              with:
-                  toolchain: 1.91.1
-                  components: cargo
             - name: Install sqlx-cli
               uses: ./.depot/actions/setup-sqlx-cli
             - name: Install Python dependencies
@@ -965,20 +966,21 @@ jobs:
             # conflicts, dead rule globs, coverage (warn-only). No --live, so no
             # secrets — fork PRs get validated too (the --live slug check runs in
             # the fork-gated validate-product-yamls job instead).
-            - name: Lint owners.yaml files
-              run: ./bin/hogli owners:lint
-            - name: Check version specifiers
-              run: python .github/scripts/check-version-specifiers.py
-            - name: Check IDOR model coverage
-              run: python .github/scripts/check-idor-model-coverage.py
-            - name: Check DWH presentation layer stays source-agnostic
-              run: python .github/scripts/check-dwh-source-agnostic.py
-            - name: Check operator parity
-              run: python .github/scripts/check-operator-parity.py
-            - name: Check module boundaries (tach)
-              run: tach check --dependencies --interfaces
-            - name: Check product facade enforcement (import-linter)
-              run: lint-imports
+            - parallel:
+                  - name: Lint owners.yaml files
+                    run: ./bin/hogli owners:lint
+                  - name: Check version specifiers
+                    run: python .github/scripts/check-version-specifiers.py
+                  - name: Check IDOR model coverage
+                    run: python .github/scripts/check-idor-model-coverage.py
+                  - name: Check DWH presentation layer stays source-agnostic
+                    run: python .github/scripts/check-dwh-source-agnostic.py
+                  - name: Check operator parity
+                    run: python .github/scripts/check-operator-parity.py
+                  - name: Check module boundaries (tach)
+                    run: tach check --dependencies --interfaces
+                  - name: Check product facade enforcement (import-linter)
+                    run: lint-imports
             # Block deleting historical migration files (see safe-django-migrations.md).
             # GITHUB_ACTIONS=false suppresses the command's PR annotations on the shadow.
             - name: Check deleted migrations
@@ -1623,10 +1625,17 @@ jobs:
             - name: Add service hostnames to /etc/hosts
               shell: bash
               run: echo "127.0.0.1 db redis7 kafka clickhouse clickhouse-coordinator objectstorage seaweedfs temporal" | sudo tee -a /etc/hosts
-            - name: Set up Python
-              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-              with:
-                  python-version: ${{ matrix.python-version }}
+            - parallel:
+                  - name: Set up Python
+                    uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+                    with:
+                        python-version: ${{ matrix.python-version }}
+                  - name: Install Rust
+                    if: needs.changes.outputs.backend == 'true'
+                    uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+                    with:
+                        toolchain: 1.91.1
+                        components: cargo
             - name: Install uv
               id: setup-uv-tests
               uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
@@ -1640,12 +1649,6 @@ jobs:
               shell: bash
               run: |
                   sudo rm -f /etc/apt/sources.list.d/*twingate* && sudo apt-get update && sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl
-            - name: Install Rust
-              if: needs.changes.outputs.backend == 'true'
-              uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
-              with:
-                  toolchain: 1.91.1
-                  components: cargo
             - name: Install sqlx-cli
               if: needs.changes.outputs.backend == 'true'
               uses: ./.depot/actions/setup-sqlx-cli

.github/scripts/flatten-parallel-steps-for-actionlint.awk

@@ -0,0 +1,28 @@
+/^[ ]*- parallel:[ ]*$/ {
+    parallel_indent = match($0, /[^ ]/) - 1
+    dedent = 0
+    in_parallel = 1
+    next
+}
+
+in_parallel {
+    if ($0 ~ /^[ ]*$/) {
+        print
+        next
+    }
+
+    indent = match($0, /[^ ]/) - 1
+    if (indent <= parallel_indent) {
+        in_parallel = 0
+        print
+        next
+    }
+
+    if (!dedent) {
+        dedent = indent - parallel_indent
+    }
+    print substr($0, dedent + 1)
+    next
+}
+
+{ print }

.github/workflows/cd-metrics-agent-image.yml

@@ -43,14 +43,15 @@ jobs:
             - name: Check out
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-            - name: Config render golden tests
-              run: products/metrics/agent/tests/render/run.sh
+            - parallel:
+                  - name: Config render golden tests
+                    run: products/metrics/agent/tests/render/run.sh
 
-            - name: Helm chart tests
-              run: products/metrics/agent/tests/helm/run.sh
+                  - name: Helm chart tests
+                    run: products/metrics/agent/tests/helm/run.sh
 
-            - name: Integration smoke test (exemplars survive scrape -> OTLP)
-              run: products/metrics/agent/tests/integration/run.sh
+                  - name: Integration smoke test (exemplars survive scrape -> OTLP)
+                    run: products/metrics/agent/tests/integration/run.sh
 
     # PR validation only: proves the multi-arch image builds, with no registry
     # logins, no push destinations, and a read-only token, so PR-controlled

.github/workflows/cd-sandbox-base-image.yml

@@ -214,68 +214,70 @@ jobs:
                   fi
                   echo "version=$version" >> "$GITHUB_OUTPUT"
 
-            - name: Build and push container image (base)
-              id: build
-              uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
-              with:
-                  context: . # use local checkout (includes downloaded artifact)
-                  file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-base
-                  buildx-fallback: false # the fallback is so slow it's better to just fail
-                  push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
-                  tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-base:master,ghcr.io/posthog/posthog-sandbox-base:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-base:{0}', github.sha) }}
-                  platforms: linux/arm64,linux/amd64
-                  build-args: |
-                      AGENT_VERSION=${{ steps.agent-version.outputs.version }}
-                      COMMIT_HASH=${{ github.sha }}
-
-            - name: Build and push container image (notebook)
-              id: build-notebook
-              uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
-              with:
-                  context: . # use local checkout (includes downloaded artifact)
-                  file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-notebook
-                  buildx-fallback: false # the fallback is so slow it's better to just fail
-                  push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
-                  tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-notebook:master,ghcr.io/posthog/posthog-sandbox-notebook:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-notebook:{0}', github.sha) }}
-                  platforms: linux/arm64,linux/amd64
-                  build-args: COMMIT_HASH=${{ github.sha }}
-
-            - name: Build and push container image (pi)
-              id: build-pi
-              uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
-              with:
-                  context: . # use local checkout (includes downloaded artifact)
-                  file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-pi
-                  buildx-fallback: false # the fallback is so slow it's better to just fail
-                  push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
-                  tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-pi:master,ghcr.io/posthog/posthog-sandbox-pi:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-pi:{0}', github.sha) }}
-                  platforms: linux/arm64,linux/amd64
-                  build-args: |
-                      BASE_IMAGE=ghcr.io/posthog/posthog-sandbox-base:${{ github.sha }}
-
-            - name: Build and push container image (vm)
-              id: build-vm
-              uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
-              with:
-                  context: . # use local checkout (includes downloaded artifact)
-                  file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-vm
-                  buildx-fallback: false # the fallback is so slow it's better to just fail
-                  push: true
-                  tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-vm:master,ghcr.io/posthog/posthog-sandbox-vm:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-vm:{0}', github.sha) }}
-                  platforms: linux/arm64,linux/amd64
-                  build-args: |
-                      BASE_IMAGE=ghcr.io/posthog/posthog-sandbox-base:${{ github.sha }}
-
-            - name: Build and push container image (streamlit)
-              id: build-streamlit
-              uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
-              with:
-                  context: . # use local checkout (includes downloaded artifact)
-                  file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-streamlit
-                  buildx-fallback: false # the fallback is so slow it's better to just fail
-                  push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
-                  tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-streamlit:master,ghcr.io/posthog/posthog-sandbox-streamlit:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-streamlit:{0}', github.sha) }}
-                  platforms: linux/arm64,linux/amd64
+            - parallel:
+                  - name: Build and push container image (base)
+                    id: build
+                    uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
+                    with:
+                        context: . # use local checkout (includes downloaded artifact)
+                        file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-base
+                        buildx-fallback: false # the fallback is so slow it's better to just fail
+                        push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
+                        tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-base:master,ghcr.io/posthog/posthog-sandbox-base:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-base:{0}', github.sha) }}
+                        platforms: linux/arm64,linux/amd64
+                        build-args: |
+                            AGENT_VERSION=${{ steps.agent-version.outputs.version }}
+                            COMMIT_HASH=${{ github.sha }}
+
+                  - name: Build and push container image (notebook)
+                    id: build-notebook
+                    uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
+                    with:
+                        context: . # use local checkout (includes downloaded artifact)
+                        file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-notebook
+                        buildx-fallback: false # the fallback is so slow it's better to just fail
+                        push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
+                        tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-notebook:master,ghcr.io/posthog/posthog-sandbox-notebook:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-notebook:{0}', github.sha) }}
+                        platforms: linux/arm64,linux/amd64
+                        build-args: COMMIT_HASH=${{ github.sha }}
+
+                  - name: Build and push container image (streamlit)
+                    id: build-streamlit
+                    uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
+                    with:
+                        context: . # use local checkout (includes downloaded artifact)
+                        file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-streamlit
+                        buildx-fallback: false # the fallback is so slow it's better to just fail
+                        push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
+                        tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-streamlit:master,ghcr.io/posthog/posthog-sandbox-streamlit:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-streamlit:{0}', github.sha) }}
+                        platforms: linux/arm64,linux/amd64
+
+            - parallel:
+                  - name: Build and push container image (pi)
+                    id: build-pi
+                    uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
+                    with:
+                        context: . # use local checkout (includes downloaded artifact)
+                        file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-pi
+                        buildx-fallback: false # the fallback is so slow it's better to just fail
+                        push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
+                        tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-pi:master,ghcr.io/posthog/posthog-sandbox-pi:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-pi:{0}', github.sha) }}
+                        platforms: linux/arm64,linux/amd64
+                        build-args: |
+                            BASE_IMAGE=ghcr.io/posthog/posthog-sandbox-base:${{ github.sha }}
+
+                  - name: Build and push container image (vm)
+                    id: build-vm
+                    uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
+                    with:
+                        context: . # use local checkout (includes downloaded artifact)
+                        file: ./products/tasks/backend/sandbox/images/Dockerfile.sandbox-vm
+                        buildx-fallback: false # the fallback is so slow it's better to just fail
+                        push: true
+                        tags: ${{ github.ref == 'refs/heads/master' && format('ghcr.io/posthog/posthog-sandbox-vm:master,ghcr.io/posthog/posthog-sandbox-vm:{0}', github.sha) || format('ghcr.io/posthog/posthog-sandbox-vm:{0}', github.sha) }}
+                        platforms: linux/arm64,linux/amd64
+                        build-args: |
+                            BASE_IMAGE=ghcr.io/posthog/posthog-sandbox-base:${{ github.sha }}
 
     # Single required status check for branch protection. Add future sandbox
     # image jobs to `needs` here rather than reconfiguring GitHub.

.github/workflows/ci-actionlint.yml

@@ -47,7 +47,14 @@ jobs:
                   SHELLCHECK_OPTS: --severity=error
               run: |
                   set -euo pipefail
-                  ./.bin/actionlint -format '{{json .}}' > actionlint.json
+                  mkdir -p /tmp/actionlint-workflows
+                  for workflow in .github/workflows/*.yml .github/workflows/*.yaml; do
+                      [ -e "$workflow" ] || continue
+                      awk -f .github/scripts/flatten-parallel-steps-for-actionlint.awk "$workflow" \
+                          > "/tmp/actionlint-workflows/$(basename "$workflow")"
+                  done
+                  ./.bin/actionlint -config-file .github/actionlint.yaml \
+                      -format '{{json .}}' /tmp/actionlint-workflows/* > actionlint.json
 
             - name: Summarize findings
               if: always()