fix(ci): unmask release build failures and fix the ui:lint synckit crash

.github/actions/dependencies-unix/action.yaml

@@ -1,5 +1,5 @@
 name: Setup Unix dependencies
-description: ''
+description: Install the Nix toolchain and expose the flake devshell to later steps.
 
 runs:
   using: composite

.github/actions/dependencies-windows/action.yaml

@@ -1,5 +1,5 @@
 name: Setup Windows dependencies
-description: ''
+description: Install the Scoop build toolchain and AzureSignTool, and pin pnpm to the version the Nix flake uses elsewhere.
 
 runs:
   using: composite

.github/actions/setup/action.yaml

@@ -1,5 +1,5 @@
 name: Setup runner
-description: ''
+description: Install the platform toolchain, Node and Go, then restore workspace and Go tool dependencies.
 
 inputs:
   shell:

.github/workflows/benchmark-generic.yml

@@ -187,11 +187,17 @@ jobs:
     name: Post Results Comment
     runs-on: ubuntu-latest
     needs: benchmark
+    # This job never actually ran until the `github.event_name` guard below was
+    # repaired, so it never needed a token that could write. The repository
+    # default is read-only, which would now turn every benchmarked PR into a 403
+    # on issues.createComment. The job only reads and writes PR comments.
+    permissions:
+      pull-requests: write
     if: |
       always() && 
       needs.benchmark.result == 'success' && 
       needs.benchmark.outputs.has-changes == 'true' &&
-      github.com.event_name == 'pull_request'
+      github.event_name == 'pull_request'
     steps:
       - name: Find and update PR comment
         uses: actions/github-script@v7

.github/workflows/release-electron-builder.yaml

@@ -6,8 +6,12 @@ on:
 jobs:
   build:
     name: Build
-    continue-on-error: true
+    # See release-go.yaml for the full rationale. Same defect, same fix: a
+    # masked failure here silently ships a desktop release missing an installer
+    # for whichever platform broke. fail-fast: false keeps the rows independent
+    # so one failure cannot cancel the others (notarization alone runs long).
     strategy:
+      fail-fast: false
       matrix:
         runner:
           - macos-15-intel # x64

.github/workflows/release-go.yaml

@@ -6,8 +6,18 @@ on:
 jobs:
   build:
     name: Build Go Binary
-    continue-on-error: true
+    # Deliberately no `continue-on-error: true`. It used to be set here, which
+    # forced every row's conclusion to success even when the build died, so
+    # cli@1.1.0 published 4 of its 6 assets behind a green check and the two
+    # broken Windows rows went unnoticed until someone opened the logs by hand.
+    # A release that cannot produce an asset must fail the run that publishes it.
+    #
+    # fail-fast: false preserves the one useful thing continue-on-error was
+    # doing by accident: rows stay independent. Without it, the first failing
+    # target would cancel the five healthy ones still in flight — including the
+    # ~20 minute darwin-x64 build — and strand the release half-published.
     strategy:
+      fail-fast: false
       matrix:
         include:
           - runner: macos-15-intel

.github/workflows/sql.yml

@@ -10,7 +10,7 @@ jobs:
     name: SQL Vet
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: sqlc-dev/setup-sqlc@v4
         with:
           sqlc-version: '1.30.0'

nx.json

@@ -23,7 +23,21 @@
     },
 
     "lint": {
-      "dependsOn": ["^pre-lint", "pre-lint"]
+      "dependsOn": ["^pre-lint", "pre-lint"],
+
+      // eslint-plugin-better-tailwindcss resolves the Tailwind design system in a
+      // synckit worker and blocks on Atomics.wait(). Building that context for
+      // packages/ui/src/styles/index.css is a cold, CPU-bound compile that the
+      // plugin caps at 30s. On a 4-vCPU CI runner with several lint targets in
+      // flight it overran the cap and ESLint died with
+      //   Internal error: Atomics.wait() failed: timed-out
+      // failing main at random. Raise the ceiling; it is a deadline, not a budget,
+      // so a healthy run never waits any longer than it does today.
+      "options": {
+        "env": {
+          "SYNCKIT_TIMEOUT": "120000"
+        }
+      }
     },
 
     "test": {

pnpm-workspace.yaml

@@ -90,7 +90,11 @@ catalog:
   eslint: 9.39.2
   eslint-config-prettier: 10.1.8
   eslint-import-resolver-typescript: 4.4.4
-  eslint-plugin-better-tailwindcss: 4.3.2
+  # 4.4.0 is the first release whose synckit worker honours SYNCKIT_TIMEOUT
+  # (4.3.2 hardcoded 30s and passed it explicitly to createSyncFn, which
+  # overrode synckit's own default, so the env var was silently ignored).
+  # nx.json raises that timeout for lint targets — see the note there.
+  eslint-plugin-better-tailwindcss: 4.4.0
   eslint-plugin-import-x: 4.16.1
   eslint-plugin-jsx-a11y: 6.10.2
   eslint-plugin-perfectionist: 5.6.0