verify.yml: drop the double-build (install-only) for gh#95

[kelp]

Summary

verify.yml used to gale build a changed recipe (for the
tar.zst + sha256) and then gale install --recipe it (to
populate the dependency farm). Since sccache is intentionally
off in verify (supply-chain hardening), that second full
compile roughly doubled heavy-recipe verify wall time. Verify
never publishes an archive, so it does not need gale build at
all.

Changes

• .github/workflows/verify.yml
  • Replace the two-step build+install with a single
    gale install --global <recipe> --recipe <file> (one build,
    populates the farm, lands the binary at its real store path).
  • Point the rpath check at the installed store prefix (no
    --prefix/--archive); same files, same baked rpaths as the
    archive, so the check is equivalent.
  • Add an "Evict target from restored store (force real build)"
    step (rm -rf "$HOME/.gale/pkg/${RECIPE_NAME}") before the
    install. The restore-only deps-<platform>- cache
    repopulates ~/.gale/pkg with any previously built revision
    of the target, and gale's installer returns MethodCached
    (no build) when the store path already exists
    (gale install --recipe has no --force). Without eviction
    the install-only flow would compile nothing and the checks
    would validate a stale cached binary. Deps stay cached,
    preserving the speedup. build-chunk.yml keeps both steps
    (its archive/sha256 feed the GHCR push).
• scripts/check_install.py
  • When neither --prefix nor --archive is given, resolve
    ~/.gale/pkg/<name>/<version>-<revision> from the recipe
    (matching verify_binary.py/run_smoke.py) and fail loudly
    if that prefix is absent.

Test notes

• New tests in scripts/test_issue95_store_prefix.py:
  resolve_prefix revision-suffix behavior, default-prefix CLI
  (scans installed store; missing prefix exits 1), and two
  workflow-structure tests asserting verify.yml evicts the target
  store before the build/checks. The eviction tests fail on the
  pre-fix tree and pass after. Full suite: 202 passing.
• actionlint clean on the changed verify.yml; shellcheck clean
  on the new step.

Closes #95

🤖 Generated with Claude Code

https://claude.ai/code/session_01USxMtcZRitDUGBEnBZ3inn

---

Note

Medium Risk
Changes the merge-gate verify path (build vs cache semantics); incorrect eviction or default prefix logic could let stale binaries pass or break rpath checks, though new workflow and CLI tests mitigate that.

Overview
Verify CI no longer runs gale build plus a second gale install --recipe. It does one gale install --global (with retries), which is enough because verify never publishes archives—build-chunk.yml still uses build+install for GHCR.

Before install, verify rm -rf ~/.gale/pkg/${RECIPE_NAME} so a restored dep cache cannot make the installer skip the target recipe with MethodCached; dependency caches stay, so heavy recipes still get the intended speedup while every run compiles the recipe under test.

check_install.py can omit --prefix / --archive: it resolves ~/.gale/pkg/<name>/<version>-<revision> from the recipe (aligned with verify_binary.py) and exits with an error if that prefix is missing. Verify’s rpath step calls it that way instead of extracting the build archive.

scripts/test_issue95_store_prefix.py covers default prefix resolution, missing-prefix failure, and that eviction runs before install and checks. CHANGELOG records the behavior change.

^{Reviewed by Cursor Bugbot for commit bba2cff. Bugbot is set up for automated code reviews on this repo. Configure here.}