Cut PR build time: stop deleting the Hugo image cache, drop GOGC=3

.github/workflows/pull-request.yml

@@ -4,6 +4,17 @@ on:
     branches:
       - master
       - 'release/**'
+
+# Only the newest commit on a PR is worth building. Without this, pushing three
+# commits in quick succession runs three full builds to completion, and the two
+# superseded ones just burn a runner and hold up the queue. Each run publishes to
+# a bucket keyed by PR number *and* head sha, so a cancelled run can only orphan
+# its own preview bucket -- pr-closed.yml deletes every *-pr-<num>-* bucket when
+# the PR closes, and bucket-cleanup.yml sweeps daily.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
       id-token: write # This is required for requesting the JWT
       contents: read # This is required for actions/checkout
@@ -90,6 +101,11 @@ jobs:
           restore-keys: |
             hugo-resources-
 
+      # PR runs don't wait on await-in-progress.js the way master deploys do, so
+      # the elapsed time here is build time with no queue wait to subtract.
+      - name: Record build start time
+        run: echo "CI_BUILD_START_EPOCH=$(date +%s)" >> "$GITHUB_ENV"
+
       - name: Build and deploy
         run: make ci_pull_request
         env:
@@ -104,6 +120,17 @@ jobs:
           ALGOLIA_APP_ADMIN_KEY: ${{  steps.esc-secrets.outputs.ALGOLIA_APP_ADMIN_KEY }}
           NODE_OPTIONS: "--max_old_space_size=8192"
 
+      # The same guardrail build-and-deploy.yml has. PR builds had none, which is
+      # how they drifted to ~17 minutes without anyone being told. 15 minutes
+      # sits a few minutes above the post-fix baseline, so it should stay quiet
+      # unless the build genuinely regresses; tighten it once that baseline settles.
+      - name: Alert on slow build
+        if: success()
+        env:
+          SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
+          BUILD_DURATION_THRESHOLD_MINUTES: '15'
+        run: ./scripts/ci-build-duration-alert.sh
+
       - name: Archive test results
         uses: actions/upload-artifact@v7
         with:

scripts/build-site.sh

@@ -27,15 +27,24 @@ printf "Generating meta images...\n\n"
 node scripts/generate-meta-images.mjs
 
 printf "Running Hugo...\n\n"
+# Hugo previously ran under GOGC=3, which collects once the heap grows 3% over
+# live heap. That capped memory but cost 1.7-3x in wall time, since every
+# allocation-heavy operation (image processing above all) drags a full GC behind
+# it. GOMEMLIMIT expresses the actual intent -- "do not exhaust the runner" --
+# as a soft ceiling, letting Go collect at its normal rate until the build
+# approaches the limit. The runner has 16GB; 12GiB leaves room for the Node and
+# Pulumi steps that share it.
+export GOMEMLIMIT=12GiB
+
 if [ "$1" == "preview" ]; then
     export HUGO_BASEURL="http://$(origin_bucket_prefix)-$(build_identifier).s3-website.$(aws_region).amazonaws.com"
-    GOGC=3 hugo --minify --buildFuture --templateMetrics -e "preview"
+    hugo --minify --buildFuture --templateMetrics -e "preview"
 else
     if [ "$DEPLOYMENT_ENVIRONMENT" == "testing" ]; then
         export HUGO_BASEURL="https://www.pulumi-test.io"
-        GOGC=3 hugo --minify --buildFuture --templateMetrics -e "preview"
+        hugo --minify --buildFuture --templateMetrics -e "preview"
     else
-        GOGC=3 hugo --minify --templateMetrics -e "production"
+        hugo --minify --templateMetrics -e "production"
     fi
 fi
 

scripts/clean.sh

@@ -1,10 +1,25 @@
 #!/bin/bash
 
-yarn cache clean
+# Locally, this is a full reset: wiping node_modules and the Hugo caches is how
+# you recover from a bad install or stale generated resources.
+#
+# CI is a different situation. The workspace is a fresh clone, so there is
+# nothing stale to remove -- but actions/cache has just restored the yarn cache
+# and Hugo's processed-image cache (resources/) into it. Deleting those here
+# throws the restore away seconds after it happened, which forces Hugo to
+# re-encode every blog feature image on every run. The caches still saved and
+# restored cleanly, so the waste was invisible in the job log.
+#
+# Skip exactly those two paths under CI. The rest are no-ops on a fresh clone
+# and are left alone so local behavior is unchanged.
+if [ -z "${CI:-}" ]; then
+    yarn cache clean
+    rm -rf resources
+fi
+
 hugo mod clean
 rm -rf node_modules
 rm -rf infrastructure/node_modules
-rm -rf resources
 rm -rf _vendor
 rm -rf public
 rm -rf cypress/screenshots