chore(ci): Warm shared caches and cut per-job install time

[charlesvien]

Problem

CI takes 7-12 minutes per PR and most of it is overhead, not tests. Three causes:

• GitHub only shares Actions caches that were saved on main. All our CI workflows run only on PRs, so nothing was ever saved on main and every new PR started cold. The macOS job alone spent ~3 minutes installing dependencies and then re-saving a cache no other PR could ever use. Each PR also stored its own ~1GB of caches, which kept evicting everything else from the repo's 10GB cache quota.
• Every pnpm install in every job compiled better-sqlite3 for Electron (~65s of node-gyp), even in jobs that never run Electron. The unit test job then immediately rebuilt it for Node, throwing the Electron build away.
• Several workflows built the same 7 workspace packages one at a time in hand-written steps.

Changes

• New warm-caches workflow runs on every push to main and saves the pnpm, Electron, Playwright and turbo caches under the keys the PR jobs restore, so PRs start warm.
• postinstall.sh skips the Electron rebuild when SKIP_ELECTRON_REBUILD=1. Jobs that never run Electron set it.
• Hand-written package build steps are replaced with turbo build --filter='@posthog/code^...', which builds the same 7 packages in parallel and reuses cached results from main.
• Removed a duplicate sqlite rebuild in the macOS job and updated stale action pins in the agent e2e job so it can hit the shared pnpm cache.

Measured on this PR's own CI, before main even has a seed: install dropped from ~95s to 13s in the Linux jobs. The macOS install and the turbo cache hits need one merge to main (or a manual gh workflow run warm-caches.yml) to kick in.

How did you test this?

• actionlint and shellcheck on all changed workflows, bash -n on postinstall.sh.
• turbo build --filter='@posthog/code^...' --dry=json to confirm the filter resolves to exactly the packages the old hand-written steps built.
• This PR's own CI runs every modified workflow end to end; all checks green.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

😎 This pull request was merged.

[greptile-apps]

_{Reviews (1): Last reviewed commit: "skip electron work and use turbo in CI j..." | Re-trigger Greptile}

[stamphog]

Note

🤖 stamphog reviewed 0bdca6ec5b64261218ae48a4beec9d6ba968cb73 — verdict: REFUSED

Gates denied on CI/infra deny-list and tier; this rewrites multiple GitHub Actions workflows and a postinstall script with no approving human or agent review, only a bot thumbs-up.

• 👍 on the PR from greptile-apps[bot].
• Touches CI/CD workflows (deny-listed infra_cicd territory) across four workflow files plus a new workflow
• No approving review present — only a Greptile comment link and a 👍 reaction, neither constitutes an approval with no unresolved concerns
• Gate verdict was DENIED (deny-list + tier failures), requiring human sign-off before merge

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: infra_cicd
size	✓	287L, 6F substantive — within ceiling
tier	✗	classified as T2-never: T2-never (287L, 6F, two-areas, chore)
stamphog 2.0.0b3		.stamphog/policy.yml @ ed26e21 · reviewed head 0bdca6e

[posthog]

👋 Visual changes detected for this PR.

Review and approve in PostHog Visual Review

If these changes are unexpected, they may be caused by a flaky test or a broken snapshot on master. Don't approve — rerun the job or wait for a fix.