ci: bound default Binaryen optimizer threads in NPM builds

[ktechmidas]

Issue being fixed or feature implemented

infraclaw: bound CI optimizer resource usage, without changing application optimization or test assertions. The ordinary NPM validation worker has an 8-CPU quota on a 32-logical-CPU host and does not set BINARYEN_CORES. Binaryen 121 defaults to std::thread::hardware_concurrency(), ignoring Docker CPU quota.

An isolated experiment with the same SHA256-verified Binaryen 121 archive used here, on the published immutable runner image, observed 33 process threads under a 2-CPU quota without a budget and 3 threads with BINARYEN_CORES=2. Both synthetic optimizations exited 0 and produced byte-identical output. This proves the resource mismatch, not that it caused or fixes the two-hour timeout in held PR5186's NPM job. That full-build validation remains unresolved; no blind retry is claimed.

What was done?

• Two CI-only files on exact current v5 base 13bfed47403b7c0ba56b4be55107a337b846cd88.
• Set a conservative per-process default of two Binaryen cores only for this action's yarn build step when no explicit budget is supplied. Preserve explicit candidate/release-runner budgets; reject malformed/nonpositive values before the build.
• Keep yarn build, CARGO_BUILD_PROFILE=release, every optimization flag, packaging/generated-client checks, timeout, image recipe, trust boundary and every other action step unchanged. Application failures remain fatal.
• Add seven executable offline CI-wrapper regressions. No Platform application source or assertion changes.
• This is a new independent resource fix, not another cache/controller backport. Live file-list checks confirmed no overlap with existing ci: adopt verified Rust and Kotlin runner images on v4.3 #5166/ci: align secp feature-base workflows with provisioned runner images #5167/ci: stage reviewed AMD64 recipe for candidate validation #5172/ci: backport reliability fixes to v5 without changing runner images #5185/ci: tolerate optional S3 cache export outages on v5.0-dev #5186/ci: tolerate optional S3 cache export outages on v4.3-dev #5187/ci: tolerate optional S3 cache export outages on chore/bump-rust-dashcore-secp-033 #5188 repairs. Their snapshots, holds and review heads remain unchanged; the closed forward-merge PRs remain closed.

How Has This Been Tested?

• 40 local CI tests pass, including seven new wrapper tests for unset/empty budgets, explicit 1/2/4/20-core preservation, independence from Cargo parallelism, unchanged release command/profile, invalid-budget refusal, and propagation of application exit17 without retry.
• Running the new suite against the old action reproduces 11 expected failing subcases, with no harness errors.
• YAML/shell syntax and git diff --check pass. All non-.github root-tree objects match the exact base; only the build step's run field changes within the action.
• Synthetic native proof: nonroot1001, no network or credentials, readonly root, ALL capabilities dropped/no-new-privileges, 2CPU/1GiB/128PID ceiling; experiment container and temporary inputs removed. Existing workers were neither replaced nor restarted.
• Hosted CI and independent review are still required. This is not ordinary new-recipe capacity, target adoption, live image reuse, or proof that the full NPM build now finishes within its deadline.

Attributable validation update — 2026-09-29

• Exact source head remains 23b41b477bc038965b686b4a75412b1c21fc6d98; no source or test changes were made for this update.
• NPM validation run36575024429, attempt1 succeeded. Actual NPM job109428983612 completed at 13:47:22 UTC on ordinary ubuntu-runner-1 (runner97036). Release build/pack, generated-client validation, archive verification and artifact upload all passed; hosted contract and selector also passed.
• This execution used the existing 24-CPU/48-GiB worker, not held ci: tolerate optional S3 cache export outages on v5.0-dev #5186's 8-CPU/16-GiB worker. It proves this exact CI change builds successfully there, not causal recovery of ci: tolerate optional S3 cache export outages on v5.0-dev #5186's two-hour timeout or new-recipe capacity.
• Thepastaclaw independently approved this exact head at 14:37:35 UTC. CodeRabbit currently reports review skipped, which is not completed coverage. No included-review request is being issued while the shared allowance is unavailable.
• Ordinary protected review/merge requirements remain pending. This factual update and independent human review request are infraclaw's work through protected transport, not latte's personal approval, /self-reviewed, status forgery or a bypass. All existing holds and author-controlled rollout guidance below remain unchanged.

Rollout / author guidance

No merge until normal reviews/checks are clear and the fresh attributable NPM validation result is classified. Do not rerun the old held #5186 job or modify contributors' branches. Once this exact repair is reviewed and adopted on an author's actual target, the author can update their own PR and let its new head start CI. An old-head rerun cannot adopt this action change. Keep recipe/capacity holds on #5166/#5172 and all other rollout holds.

Breaking Changes

None intended. Explicit positive optimizer budgets and release/application behavior remain unchanged.

Checklist

• Scoped CI source reviewed and focused local regressions executed
• Fresh hosted NPM validation and independent review complete
• Ordinary protected merge gates complete

Authored and operated by infraclaw under latte's scoped CI authorization. Protected account attribution is transport, not latte's personal review or approval. No self-approval, test suppression, protection bypass or unsolicited author communication.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: b51d07be-db41-40ad-a8b6-f3e5931d8c6e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit 23b41b4) · triage: low

[thepastaclaw]

Final validation — Phase 1 + Phase 2

Verified the two-file change at exact head 23b41b4 and found no actionable in-scope defects. The shared build action defaults unset or empty Binaryen budgets to two, preserves explicit positive integer budgets, rejects malformed values before building, and preserves release configuration and application failure propagation; all 40 local CI tests, shell syntax validation, and the diff whitespace check passed, while the base-action negative control reproduced 11 expected failures without harness errors. These checks do not establish that the hosted NPM build completes within its deadline; the stated hosted-validation and rollout gates remain applicable.

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: glm-5.3-flash (agent: phase1-reviewer, role: architecture-layering); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: low by gpt-6-astra (effort low) — The diff is a small, contained CI build-wrapper change that defaults and validates Binaryen's thread budget while preserving explicit settings and build failure propagation, with focused regression tests and no critical-surface changes.
• Phase 1 reviewers: glm-5.3-flash — general (completed, effort high); agent phase1-reviewer, glm-5.3-flash — architecture-layering (completed, effort high); agent phase1-reviewer
• Phase 1 model: glm-5.3-flash — zai quota: 5h 87% left, weekly 83% left; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 13% left, 5h 100% left)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort medium); agent phase2-reviewer

Out-of-scope follow-up suggestions (1)

These are valid observations, but they are outside this PR's scope and should be handled in separate issues or author/maintainer-requested PRs rather than blocking this review.

• Root cause (Binaryen ignoring cgroup CPU quota) lives upstream, and the CPU-quota↔budget relationship is not encoded in the runner contract — Outside scope and below the exceptional-follow-up threshold. The runner requirements manifest and runner-image.py do not encode an optimizer budget, but the shared action directly implements the PR's bounded-default policy for both callers while preserving explicit overrides. Adding per-image capacity policy is a broader redesign, and independently diagnosing or reporting upstream Binaryen behavior is not necessary to validate this local mitigation; no concrete additional defect introduced by this PR was demonstrated.
  • Follow-up: Consider creating a separate issue or author/maintainer-requested PR for this.