ci: only run what a change affects, consolidate jobs (#3674)

* ci: only run what a change affects, consolidate jobs

- detect affected plugins from changed files and Cargo.lock dependency trees
- test/lint Rust per platform in shards instead of one job per plugin
- fold check-generated-files into lint-javascript, fmt into a single job
- skip fat LTO in integration test builds, single ABI in test-android

* ci: run e2e on bumps, use published tauri CLI, PR-safe pnpm cache

- trigger e2e on Cargo/pnpm lockfile and manifest changes
- install the latest 2.x tauri-cli with cargo-binstall in integration tests
- add setup-pnpm action: restore the store everywhere, save only on v2/v3

* fix clippy, ios build

* fix bumps [skip ci]

.github/workflows/lint-javascript.yml

@@ -9,26 +9,27 @@ on:
     branches:
       - v1
       - v2
-    paths:
+    paths: &paths
       - '.github/workflows/lint-javascript.yml'
+      - '.github/actions/setup-pnpm/**'
       - 'plugins/*/guest-js/**'
+      # generated by `pnpm build`, checked below
+      - 'plugins/*/api-iife.js'
+      - 'plugins/*/src/init-iife.js'
+      - 'plugins/*/rollup.config.js'
+      - 'plugins/*/tsconfig.json'
+      - 'shared/**'
       - 'packages/**'
-      - '.eslintignore'
-      - '.eslintrc.json'
-      - '.prettierignore'
+      - 'eslint.config.js'
+      - 'tsconfig.base.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
       - '**/package.json'
   pull_request:
     branches:
       - v1
       - v2
-    paths:
-      - '.github/workflows/lint-javascript.yml'
-      - 'plugins/*/guest-js/**'
-      - 'packages/**'
-      - '.eslintignore'
-      - '.eslintrc.json'
-      - '.prettierignore'
-      - '**/package.json'
+    paths: *paths
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -42,18 +43,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 'lts/*'
-      - uses: pnpm/action-setup@v6
-        with:
-          run_install: true
-          cache: true # the pnpm store, keyed by OS and lockfile hash and shared by every workflow
+      - uses: ./.github/actions/setup-pnpm
       # the type-checked lint rules (and packages/api-e2e) resolve the plugins'
       # types from their dist-js build output
       - name: build
+        id: build
         run: pnpm build
       - name: eslint
         run: pnpm lint
       - name: ts:check
         run: pnpm ts:check
+      # the build above regenerates the `api-iife.js` and `init-iife.js` files the Rust crates
+      # embed, which must be committed along with the guest-js changes they come from
+      - name: check generated files are up to date
+        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
+        run: ./.scripts/ci/has-diff.sh