* ci: gate omnivoice-tts build to pin changes; drop hanging Intel-Mac leg
The omnivoice-tts C++ runtime is pinned to a commit SHA in quant_map.json, so
it only needs rebuilding when that pin (or the build script) changes — not on
every PR/push. Running it per-push left the heavily-contended hosted macOS
runners (esp. Intel macos-13) sitting in "Waiting for a runner…" for hours as
a perpetual queued check (the UNSTABLE state on every PR).
- Moved the build out of ci.yml into its own workflow,
.github/workflows/build-omnivoice-tts.yml, gated to:
paths [quant_map.json, scripts/build-omnivoice-tts.sh, the workflow] +
workflow_dispatch. Normal PRs no longer trigger (or hang on) it.
- Dropped the Intel darwin-x86_64 (macos-13) matrix leg: that hosted pool is
unusably contended and Apple's momentum is on arm64; Intel-Mac users get the
in-process OmniVoiceBackend fallback (already the documented behavior).
Kept linux-x86_64, windows-x86_64, darwin-arm64. Re-add macos-13 here if
first-class Intel binaries are ever needed.
Both workflows YAML-validated. Matches ci.yml's stated philosophy of keeping
heavy platform builds off the per-PR path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci: timeout-minutes + injection-harden the omnivoice-tts build (bot review)
- Greptile: add `timeout-minutes: 45` so a hung leg (esp. experimental
darwin-arm64 Metal) can't run to GitHub's 6h ceiling — same resource-drain
class this PR addresses.
- CodeRabbit: stop interpolating the pinned SHA / platform directly into the
run block. Validate the SHA is a git hash in the pin step, then pass it +
platform via quoted env vars (no shell-injection surface from quant_map.json).
Declined: SHA-pinning actions@v4 — matches the repo's floating-tag convention
(ci.yml/release.yml); belongs in a repo-wide hardening pass + Dependabot.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
