perf(ci): upload only current portable build cache entries

Stage only the current portable Turbo task archives, metadata and available manifests for same-run artifact consumers. Share task identity/hash validation with cross-run keys and fail publication on incomplete preparation, while retaining existing cache authority and consumer build/prepack verification.

Validation: 252 focused tests, full check:ci, docs:check, check:fast, actionlint, real Turbo output equivalence and invalidation, restored CLI/MCP scenarios and full Linux package verification passed. Fault injection detected historical-entry inclusion. Exact-head hosted CI and available review passed; measurement limits are recorded in the PR.

Refs #4744.

.github/actions/portable-build-cache/action.yml

@@ -24,19 +24,7 @@ runs:
         BUILD_CACHE_PREFIX: rea-portable-build-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.npmrc', '.nvmrc', 'package-lock.json') }}
       run: |
         npm run --silent test:prepare -- --dry=json |
-          node --input-type=module -e '
-            import { createHash } from "node:crypto";
-            import { readFileSync } from "node:fs";
-            const { tasks } = JSON.parse(readFileSync(0, "utf8"));
-            const hashes = tasks.map(({ taskId, hash }) => {
-              if (typeof hash !== "string")
-                throw new Error(`Build task ${taskId} must have an eager Turbo hash`);
-              return `${taskId}:${hash}`;
-            }).sort();
-            const hash = createHash("sha256").update(hashes.join("\n")).digest("hex");
-            console.log(`key=${process.env.BUILD_CACHE_PREFIX}-${hash}`);
-            console.log(`prefix=${process.env.BUILD_CACHE_PREFIX}-`);
-          ' >> "$GITHUB_OUTPUT"
+          node scripts/ci/portable-build-cache.mjs key >> "$GITHUB_OUTPUT"
     - name: Restore portable build outputs
       if: inputs.build_cache_artifact == '' && inputs.save != 'true'
       uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0

.github/workflows/ci.yml

@@ -357,10 +357,15 @@ jobs:
       # test:prepare caches only portable JS, skill, and catalog outputs.
       # Native package jobs still run their build and prepack checks; Turbo
       # restores matching outputs or rebuilds when their inputs differ.
+      - name: Stage current portable build task cache
+        shell: bash
+        run: |
+          npm run --silent test:prepare -- --dry=json |
+            node scripts/ci/portable-build-cache.mjs snapshot
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: rea-build-cache
-          path: .turbo/cache/
+          path: .cache/ci-build-cache/
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 7