ci: fix pipeline flow - tests→build→docs→release with fail-fast

.gitea/workflows/build_dashboard.yaml

@@ -23,22 +23,34 @@ jobs:
         with:
           node-version: '24'
 
+      - name: Hash source files
+        id: hash-src
+        run: echo "hash=$(find apps/dashboard-ui -type f \( -name '*.vue' -o -name '*.ts' -o -name '*.js' -o -name '*.css' -o -name '*.json' -o -name '*.html' \) | sort | xargs sha256sum | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@v3
+        id: cache-build
+        with:
+          path: apps/dashboard-ui/dist
+          key: build-dashboard-${{ steps.hash-src.outputs.hash }}
+
       - name: Hash package-lock
         id: hash-npm
         run: echo "hash=$(sha256sum apps/dashboard-ui/package-lock.json | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
 
       - uses: actions/cache@v3
+        id: cache-npm
         with:
-          path: |
+          path: ~/.npm
-            ~/.npm
           key: npm-dashboard-${{ steps.hash-npm.outputs.hash }}
           restore-keys: npm-dashboard-
 
       - name: Install
+        if: steps.cache-build.outputs.cache-hit != 'true'
         working-directory: apps/dashboard-ui
         run: npm ci || npm install
 
       - name: Build
+        if: steps.cache-build.outputs.cache-hit != 'true'
         working-directory: apps/dashboard-ui
         run: npm run build
 

.gitea/workflows/build_device_agent.yaml

@@ -24,7 +24,29 @@ jobs:
           go-version: '1.26'
           cache: true
 
+      - uses: https://gitea.com/actions/go-hashfiles@v0.0.1
+        id: hash-src
+        with:
+          patterns: |
+            apps/device-agent/**/*.go
+            apps/device-agent/go.mod
+            apps/device-agent/go.sum
+
+      - uses: actions/cache@v3
+        id: cache-build
+        with:
+          path: apps/device-agent/bin
+          key: build-device-agent-${{ steps.hash-src.outputs.hash }}
+
+      - name: Generate Windows resources (UAC manifest + icon)
+        if: steps.cache-build.outputs.cache-hit != 'true'
+        working-directory: apps/device-agent
+        run: |
+          go install github.com/tc-hib/go-winres@latest
+          go-winres make
+
       - name: Build all platforms
+        if: steps.cache-build.outputs.cache-hit != 'true'
         working-directory: apps/device-agent
         shell: bash
         run: |

.gitea/workflows/build_server_core.yaml

@@ -24,13 +24,31 @@ jobs:
           go-version: '1.26'
           cache: true
 
+      - uses: https://gitea.com/actions/go-hashfiles@v0.0.1
+        id: hash-src
+        with:
+          patterns: |
+            apps/server-core/**/*.go
+            apps/server-core/go.mod
+            apps/server-core/go.sum
+
+      - uses: actions/cache@v3
+        id: cache-build
+        with:
+          path: |
+            apps/server-core/bin
+            apps/server-core/docs
+          key: build-server-core-${{ steps.hash-src.outputs.hash }}
+
       - name: Generate Swagger docs
+        if: steps.cache-build.outputs.cache-hit != 'true'
         working-directory: apps/server-core
         run: |
           go install github.com/swaggo/swag/cmd/swag@v1.16.6
           swag init -g main.go --parseDependency --parseInternal
 
       - name: Build
+        if: steps.cache-build.outputs.cache-hit != 'true'
         working-directory: apps/server-core
         run: go build -o bin/server-core .
 

.gitea/workflows/ci.yml

@@ -10,9 +10,11 @@ on:
       - 'v[0-9]*.[0-9]*.[0-9]'
 
 jobs:
-  # --- TESTS (test tags + stable release tags) ---
+  # ====================================================================
+  # TESTS — test tags only
+  # ====================================================================
   server-core-test:
-    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
+    if: contains(gitea.ref_name, 'test')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -26,17 +28,13 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
-      - name: Generate swagger docs
+          cache: true
-        working-directory: apps/server-core
-        run: |
-          go install github.com/swaggo/swag/cmd/swag@v1.16.6
-          swag init -g main.go --parseDependency --parseInternal
       - name: Test (skip nftables - needs root)
         working-directory: apps/server-core
         run: go test $(go list ./... | grep -v internal/firewall) -tags dev -cover -count=1
 
   device-agent-test:
-    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
+    if: contains(gitea.ref_name, 'test')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -50,12 +48,13 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
+          cache: true
       - name: Test
         working-directory: apps/device-agent
         run: go test ./... -cover
 
   dashboard-test:
-    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
+    if: contains(gitea.ref_name, 'test')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -76,37 +75,45 @@ jobs:
         working-directory: apps/dashboard-ui
         run: npm run build
 
-  # --- BUILD + RELEASE (dev/beta/release tags) ---
+  # ====================================================================
+  # BUILD — after tests pass (release) or directly (dev/beta)
+  # ====================================================================
   build-server-core:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
+    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
     needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_server_core.yaml
     secrets: inherit
 
   build-device-agent:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
+    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
     needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_device_agent.yaml
     secrets: inherit
 
   build-dashboard:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
+    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
     needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_dashboard.yaml
     secrets: inherit
 
+  # ====================================================================
+  # DOCS — after builds pass, release tags only
+  # ====================================================================
   build-docs:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
+    if: always() && !contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
-    needs: [server-core-test, device-agent-test, dashboard-test]
+    needs: [build-server-core, build-device-agent, build-dashboard]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/docs_call.yaml
     secrets: inherit
 
+  # ====================================================================
+  # RELEASE — after everything passes
+  # ====================================================================
   release:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
+    if: always() && !contains(gitea.ref_name, 'test') && !failure() && !cancelled()
     needs: [build-server-core, build-device-agent, build-dashboard, build-docs]
     uses: ./.gitea/workflows/release_call.yaml
     with:

.gitea/workflows/docs_call.yaml

@@ -21,6 +21,17 @@ jobs:
         with:
           node-version: '24'
 
+      - name: Hash package-lock
+        id: hash-npm
+        run: echo "hash=$(sha256sum apps/docs/package-lock.json 2>/dev/null || echo 'none') | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/.npm
+          key: npm-docs-${{ steps.hash-npm.outputs.hash }}
+          restore-keys: npm-docs-
+
       - name: Install
         working-directory: apps/docs
         run: npm ci || npm install