From 11006822613ec945df0a6f68dda4d4d10dbc312c Mon Sep 17 00:00:00 2001
From: Devin Foley <devin@devinfoley.com>
Date: Sat, 10 Oct 2026 10:51:46 -0700
Subject: [PATCH] ci: move the Grok public-install verification off Canary Dry
 Run (#15213)

Move the 'Verify built-in Grok from a clean public npm install' step from the Canary Dry Run lane to the end of the Build lane in pr-trusted.yml. The verifier only needs pnpm build output, which Build already produces. Expected: Canary Dry Run drops from ~484-572s to ~275-350s, and the run's critical path moves to the server (2/12) shard.
---
 .github/workflows/pr-trusted.yml | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-trusted.yml b/.github/workflows/pr-trusted.yml
index 9b1d175b370..5f02a99c5f4 100644
--- a/.github/workflows/pr-trusted.yml
+++ b/.github/workflows/pr-trusted.yml
@@ -1002,6 +1002,20 @@ jobs:
       - name: Build
         run: pnpm build
 
+      # This verification only needs `pnpm build` output (the verifier stages
+      # the public packages' dist and reuses ui/dist itself), yet it ran at the
+      # end of Canary Dry Run, serially after the ~210-295s release.sh dry run.
+      # That made Canary Dry Run the slowest check in every green PR run:
+      # 484s, 572s and 483s in runs 37310951026, 37309272947 and 37308895471
+      # (2026-10-05), with this step alone at 210-223s of each. The Build lane
+      # finished its `pnpm build` in ~206s total in those same runs, so it
+      # absorbs the step at ~416s while Canary Dry Run drops to ~275-350s and
+      # neither remains the critical path (server 2/12 at ~437-467s is).
+      # docker-runner-check.yml runs the same verifier after `pnpm build`.
+      - name: Verify built-in Grok from a clean public npm install
+        if: ${{ hashFiles('scripts/verify-grok-npm-install.mjs') != '' }}
+        run: node scripts/verify-grok-npm-install.mjs
+
   verify_serialized_server:
     name: Verify serialized server suites (${{ matrix.shard_label }})
     needs: [gate]
@@ -1246,9 +1260,11 @@ jobs:
               commit --no-verify -m "ci(canary): stage regenerated lockfile"
           fi
           ./scripts/release.sh canary --skip-verify --dry-run
-      - name: Verify built-in Grok from a clean public npm install
-        if: ${{ hashFiles('scripts/verify-grok-npm-install.mjs') != '' }}
-        run: node scripts/verify-grok-npm-install.mjs
+
+      # The clean public npm install verification for the built-in Grok
+      # provider used to run here, after the dry run. It only needs `pnpm
+      # build` output, which the Build lane also produces, so it moved there:
+      # see "Verify built-in Grok from a clean public npm install" in `build`.
 
 
   e2e_shards: