ci: right-size pipelines, fix prerelease latest.json overwrite (#4582)

- build.yml: update latest.json only for stable release tags
  (alpha/beta/rc tags previously overwrote the stable pointer with
  release_type "stable"); drop the placeholder .asc files; build the
  Linux targets only on main pushes (tags/schedule/dispatch keep the
  full matrix); remove the unreachable --build clause and a needless
  full-history clone
- ci.yml: event-scoped concurrency so merges stop cancelling the
  weekly scheduled run; drop the redundant skip-duplicate-actions
  gate job; run clippy before tests; trim the unused toolchain from
  the typos job
- ci-docs-only.yml (new): satisfy the required "Test and Lint" check
  on docs-only PRs that ci.yml skips via paths-ignore
- audit.yml: drop cargo-audit (cargo-deny advisories covers the same
  RustSec database); same event-scoped concurrency fix
- docker.yml: job-level short-circuit for per-merge dev builds; send
  the Trivy SARIF to code scanning; unify the upload-artifact pin
- performance-ab.yml: add concurrency; only re-run on labeled events
  when the added label is perf-ab
- stagger the Sunday crons (build 01:00, audit 03:00,
  nix-flake-update 05:00, mint 06:00)
- delete performance.yml: disabled since 2025-07; idle-server
  profiling, no benchmark baseline, stale ecstore package name

.github/workflows/ci.yml

@@ -33,10 +33,11 @@ on:
       - ".github/workflows/build.yml"
       - ".github/workflows/docker.yml"
       - ".github/workflows/audit.yml"
-      - ".github/workflows/performance.yml"
   pull_request:
     types: [ opened, synchronize, reopened, closed ]
     branches: [ main ]
+    # Keep this list in sync with the `paths` list in ci-docs-only.yml, which
+    # reports the required "Test and Lint" check for PRs skipped here.
     paths-ignore:
       - "**.md"
       - "docs/**"
@@ -53,7 +54,6 @@ on:
       - ".github/workflows/build.yml"
       - ".github/workflows/docker.yml"
       - ".github/workflows/audit.yml"
-      - ".github/workflows/performance.yml"
   merge_group:
     types: [ checks_requested ]
   schedule:
@@ -63,9 +63,13 @@ on:
 permissions:
   contents: read
 
+# Concurrency groups are scoped per event so different triggers never cancel
+# each other: PR pushes cancel the previous run of that PR, main pushes keep
+# latest-wins semantics among themselves, and scheduled runs always complete
+# (a shared group used to let every merge kill the weekly scheduled run).
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'schedule' }}
 
 env:
   CARGO_TERM_COLOR: always
@@ -81,33 +85,12 @@ jobs:
       - name: Explain cancellation run
         run: echo "PR closed; this run only cancels older runs in the same concurrency group."
 
-  skip-check:
-    name: Skip Duplicate Actions
-    if: github.event_name != 'pull_request' || github.event.action != 'closed'
-    permissions:
-      actions: write
-      contents: read
-    runs-on: ubuntu-latest
-    outputs:
-      should_skip: ${{ steps.skip_check.outputs.should_skip }}
-    steps:
-      - name: Skip duplicate actions
-        id: skip_check
-        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5
-        with:
-          concurrent_skipping: "same_content_newer"
-          cancel_others: true
-          paths_ignore: '["*.md", "docs/**", "deploy/**"]'
-          do_not_skip: '["workflow_dispatch", "schedule", "merge_group", "release", "push"]'
-
   typos:
     name: Typos
-    needs: skip-check
-    if: needs.skip-check.outputs.should_skip != 'true'
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - name: Typos check with custom config file
         uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # master
 
@@ -115,8 +98,7 @@ jobs:
   # ~1 minute instead of waiting for the full test job.
   quick-checks:
     name: Quick Checks
-    needs: skip-check
-    if: needs.skip-check.outputs.should_skip != 'true'
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -148,8 +130,7 @@ jobs:
 
   test-and-lint:
     name: Test and Lint
-    needs: skip-check
-    if: needs.skip-check.outputs.should_skip != 'true'
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: sm-standard-4
     timeout-minutes: 60
     env:
@@ -166,6 +147,12 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           cache-save-if: ${{ github.ref == 'refs/heads/main' }}
 
+      # Clippy runs before the test pass: lint failures are the most common
+      # CI-only breakage and should surface in minutes, not after 20+ minutes
+      # of tests.
+      - name: Run clippy lints
+        run: cargo clippy --all-targets -- -D warnings
+
       - name: Run tests
         run: |
           cargo nextest run --all --exclude e2e_test
@@ -179,13 +166,9 @@ jobs:
           cargo nextest run -p rustfs-ecstore --lib \
             -E 'test(data_movement) or test(rebalance) or test(decommission) or test(source_cleanup) or test(delete_marker)'
 
-      - name: Run clippy lints
-        run: cargo clippy --all-targets -- -D warnings
-
   test-and-lint-rio-v2:
     name: Test and Lint (rio-v2)
-    needs: skip-check
-    if: needs.skip-check.outputs.should_skip != 'true'
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: sm-standard-4
     timeout-minutes: 60
     env:
@@ -202,18 +185,17 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           cache-save-if: ${{ github.ref == 'refs/heads/main' }}
 
+      - name: Run rio-v2 clippy lints
+        run: cargo clippy -p rustfs -p rustfs-ecstore --all-targets --features rio-v2 -- -D warnings
+
       - name: Run rio-v2 feature tests
         run: |
           cargo nextest run -p rustfs -p rustfs-ecstore --features rio-v2
           cargo test -p rustfs --doc --features rio-v2
 
-      - name: Run rio-v2 clippy lints
-        run: cargo clippy -p rustfs -p rustfs-ecstore --all-targets --features rio-v2 -- -D warnings
-
   test-and-lint-protocols:
     name: "Test and Lint (${{ matrix.features.name }})"
-    needs: skip-check
-    if: needs.skip-check.outputs.should_skip != 'true'
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: sm-standard-4
     timeout-minutes: 60
     strategy:
@@ -238,18 +220,17 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           cache-save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      - name: Run tests with ${{ matrix.features.name }}
-        run: |
-          cargo nextest run -p rustfs -p rustfs-protocols ${{ matrix.features.flags }}
-
       - name: Run clippy with ${{ matrix.features.name }}
         run: |
           cargo clippy -p rustfs -p rustfs-protocols --all-targets ${{ matrix.features.flags }} -- -D warnings
 
+      - name: Run tests with ${{ matrix.features.name }}
+        run: |
+          cargo nextest run -p rustfs -p rustfs-protocols ${{ matrix.features.flags }}
+
   build-rustfs-debug-binary:
     name: Build RustFS Debug Binary
-    needs: skip-check
-    if: needs.skip-check.outputs.should_skip != 'true'
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: sm-standard-4
     timeout-minutes: 30
     env:
@@ -279,8 +260,7 @@ jobs:
 
   build-rustfs-debug-binary-rio-v2:
     name: Build RustFS Debug Binary (rio-v2)
-    needs: skip-check
-    if: needs.skip-check.outputs.should_skip != 'true'
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: sm-standard-4
     timeout-minutes: 30
     env:
@@ -310,8 +290,7 @@ jobs:
 
   e2e-tests:
     name: End-to-End Tests
-    needs: [ skip-check, build-rustfs-debug-binary ]
-    if: needs.skip-check.outputs.should_skip != 'true'
+    needs: [ build-rustfs-debug-binary ]
     runs-on: sm-standard-2
     timeout-minutes: 30
     steps:
@@ -370,8 +349,7 @@ jobs:
 
   e2e-tests-rio-v2:
     name: End-to-End Tests (rio-v2)
-    needs: [ skip-check, build-rustfs-debug-binary-rio-v2 ]
-    if: needs.skip-check.outputs.should_skip != 'true'
+    needs: [ build-rustfs-debug-binary-rio-v2 ]
     runs-on: sm-standard-2
     timeout-minutes: 30
     steps:
@@ -417,8 +395,7 @@ jobs:
 
   s3-implemented-tests:
     name: S3 Implemented Tests
-    needs: [ skip-check, build-rustfs-debug-binary, e2e-tests ]
-    if: needs.skip-check.outputs.should_skip != 'true'
+    needs: [ build-rustfs-debug-binary, e2e-tests ]
     runs-on: sm-standard-4
     timeout-minutes: 60
     steps: