ci: app test workflows save no caches, reuse their builds as artifacts, and run Claude in its own job (#7767)

.github/workflows/desktop-linux.yml

@@ -15,7 +15,11 @@ on:
         type: boolean
         default: false
       backend:
-        description: Also start the test backend and test the released app
+        description: Also start the test backend
+        type: boolean
+        default: false
+      release:
+        description: Also test the latest released app, to tell a branch's failure from the runner's
         type: boolean
         default: false
 
@@ -24,8 +28,8 @@ permissions:
   actions: read
 
 concurrency:
-  # a push that asks for no run doesn't cancel one that does
-  group: desktop-linux-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' || contains(github.event.head_commit.message, '[app-ci]') || contains(github.event.head_commit.message, '[app-ci:desktop]') || contains(github.event.head_commit.message, '[claude-test]') || contains(github.event.head_commit.message, '[claude-test:desktop]') }}
+  # a push that asks for no run must not cancel one that does
+  group: desktop-linux-${{ github.ref }}-${{ (github.event_name == 'workflow_dispatch' || contains(github.event.head_commit.message, '[app-ci]') || contains(github.event.head_commit.message, '[app-ci:desktop]') || contains(github.event.head_commit.message, '[claude-test]') || contains(github.event.head_commit.message, '[claude-test:desktop]')) && 'requested' || github.run_id }}
   cancel-in-progress: true
 
 env:
@@ -38,6 +42,7 @@ env:
 jobs:
   plan:
     name: choose jobs, find earlier builds
+    # the concurrency group repeats this test, as it can't read job outputs
     if: >-
       github.event_name == 'workflow_dispatch' ||
       contains(github.event.head_commit.message, '[app-ci]') ||
@@ -49,6 +54,10 @@ jobs:
     outputs:
       run-claude: ${{ steps.jobs.outputs.claude }}
       run-backend: ${{ steps.jobs.outputs.backend }}
+      run-release: ${{ steps.jobs.outputs.release }}
+      claude-backend: ${{ steps.scope.outputs.backend }}
+      core: ${{ steps.names.outputs.core }}
+      core-run: ${{ steps.core.outputs.run-id }}
       backend: ${{ steps.names.outputs.backend }}
       backend-run: ${{ steps.backend.outputs.run-id }}
     steps:
@@ -57,19 +66,46 @@ jobs:
         env:
           CLAUDE: ${{ inputs.claude || contains(github.event.head_commit.message, '[claude-test]') || contains(github.event.head_commit.message, '[claude-test:desktop]') }}
           BACKEND: ${{ inputs.backend || contains(github.event.head_commit.message, '[ci-backend]') }}
+          RELEASE: ${{ inputs.release || contains(github.event.head_commit.message, '[ci-release]') }}
         run: |
           echo "claude=$CLAUDE" | tee -a "$GITHUB_OUTPUT"
           echo "backend=$BACKEND" | tee -a "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" | tee -a "$GITHUB_OUTPUT"
 
       - name: Checkout code
-        if: steps.jobs.outputs.backend == 'true'
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
+
+      - name: Claude scope
+        id: scope
+        if: steps.jobs.outputs.claude == 'true'
+        env:
+          BACKEND: ${{ steps.jobs.outputs.backend }}
+        run: |
+          backend=$(sed -n 's/^backend: *//p' scripts/ci/desktop-linux/claude-scope)
+          case "$backend" in
+            yes | no) echo "backend=$backend" | tee -a "$GITHUB_OUTPUT" ;;
+            *)
+              echo "::error::claude-scope must say backend: yes or backend: no"
+              exit 1
+              ;;
+          esac
+          if [ "$backend" = yes ] && [ "$BACKEND" != true ]; then
+            echo "::error::claude-scope says the Claude session uses the test backend: ask for it too"
+            exit 1
+          fi
 
       # artifacts are named after the sources they are built from, so a run uses one that an earlier run uploaded
       - name: Artifact names
         id: names
-        if: steps.jobs.outputs.backend == 'true'
-        run: echo "backend=desktop-linux-backend-${{ hashFiles('src/**', 'apps/simplex-chat/**', 'apps/simplex-directory-service/Main.hs', 'apps/simplex-directory-service/src/**', 'cabal.project', 'simplex-chat.cabal', 'scripts/ci/desktop-linux/build-backend.sh') }}" >> "$GITHUB_OUTPUT"
+        run: |
+          echo "core=desktop-linux-core-${{ hashFiles('src/**', 'cabal.project', 'simplex-chat.cabal', 'PRIVACY.md', 'scripts/desktop/build-lib-linux.sh', 'scripts/ci/desktop-linux/build-core.sh') }}" >> "$GITHUB_OUTPUT"
+          echo "backend=desktop-linux-backend-${{ hashFiles('src/**', 'apps/simplex-chat/**', 'apps/simplex-directory-service/Main.hs', 'apps/simplex-directory-service/src/**', 'cabal.project', 'simplex-chat.cabal', 'scripts/ci/desktop-linux/build-backend.sh') }}" >> "$GITHUB_OUTPUT"
+
+      - name: Find core library
+        id: core
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: scripts/ci/desktop-linux/earlier-run.sh "${{ steps.names.outputs.core }}"
 
       - name: Find backend
         id: backend
@@ -86,7 +122,7 @@ jobs:
     timeout-minutes: 150
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Show runner
         run: |
@@ -96,26 +132,11 @@ jobs:
           df -h /
 
       - name: Setup Haskell
-        id: haskell
         uses: simplex-chat/setup-haskell-action@v2
         with:
           ghc-version: ${{ env.GHC_VER }}
           cabal-version: ${{ env.CABAL_VER }}
 
-      # before the first backend store exists, the core library's has most of the same Hackage dependencies
-      - name: Restore cabal store
-        id: cabal-cache
-        uses: actions/cache/restore@v5
-        with:
-          path: |
-            ${{ steps.haskell.outputs.cabal-store }}
-            dist-newstyle
-          key: desktop-linux-backend-store-ghc${{ env.GHC_VER }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}-${{ github.run_id }}
-          restore-keys: |
-            desktop-linux-backend-store-ghc${{ env.GHC_VER }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}-
-            desktop-linux-backend-store-ghc${{ env.GHC_VER }}-
-            desktop-linux-core-store-ghc${{ env.GHC_VER }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}-
-
       - name: Install libraries
         run: |
           sudo apt-get update
@@ -124,17 +145,8 @@ jobs:
       - name: Build backend
         run: scripts/ci/desktop-linux/build-backend.sh ~/backend/${{ env.BACKEND_PKG }}
 
-      - name: Save cabal store
-        if: ${{ !cancelled() }}
-        uses: actions/cache/save@v5
-        with:
-          path: |
-            ${{ steps.haskell.outputs.cabal-store }}
-            dist-newstyle
-          key: ${{ steps.cabal-cache.outputs.cache-primary-key }}
-
       - name: Upload backend
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ needs.plan.outputs.backend }}
           path: ~/backend/${{ env.BACKEND_PKG }}
@@ -145,11 +157,12 @@ jobs:
   core:
     name: core library for Linux
     needs: plan
+    if: needs.plan.outputs.core-run == ''
     runs-on: ubuntu-24.04
     timeout-minutes: 150
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Show runner
         run: |
@@ -158,79 +171,39 @@ jobs:
           free -h
           df -h /
 
-      - name: Restore core library
-        id: core-cache
-        uses: actions/cache/restore@v5
-        with:
-          path: ~/core/${{ env.CORE_PKG }}
-          key: desktop-linux-core-${{ hashFiles('src/**', 'cabal.project', 'simplex-chat.cabal', 'PRIVACY.md', 'scripts/desktop/build-lib-linux.sh', 'scripts/ci/desktop-linux/build-core.sh') }}
-
       - name: Setup Haskell
-        id: haskell
-        if: steps.core-cache.outputs.cache-hit != 'true'
         uses: simplex-chat/setup-haskell-action@v2
         with:
           ghc-version: ${{ env.GHC_VER }}
           cabal-version: ${{ env.CABAL_VER }}
 
-      - name: Restore cabal store
-        id: cabal-cache
-        if: steps.core-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/restore@v5
-        with:
-          path: |
-            ${{ steps.haskell.outputs.cabal-store }}
-            dist-newstyle
-          key: desktop-linux-core-store-ghc${{ env.GHC_VER }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}-${{ github.run_id }}
-          restore-keys: |
-            desktop-linux-core-store-ghc${{ env.GHC_VER }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}-
-            desktop-linux-core-store-ghc${{ env.GHC_VER }}-
-
       - name: Install libraries
-        if: steps.core-cache.outputs.cache-hit != 'true'
         run: |
           sudo apt-get update
           sudo apt-get install -y libffi-dev libgmp-dev libnuma-dev libssl-dev zlib1g-dev patchelf
 
       - name: Build core library
-        if: steps.core-cache.outputs.cache-hit != 'true'
         run: scripts/ci/desktop-linux/build-core.sh ~/core/${{ env.CORE_PKG }}
 
-      - name: Save cabal store
-        if: ${{ !cancelled() && steps.core-cache.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@v5
-        with:
-          path: |
-            ${{ steps.haskell.outputs.cabal-store }}
-            dist-newstyle
-          key: ${{ steps.cabal-cache.outputs.cache-primary-key }}
-
-      - name: Save core library
-        if: steps.core-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
-        with:
-          path: ~/core/${{ env.CORE_PKG }}
-          key: ${{ steps.core-cache.outputs.cache-primary-key }}
-
       - name: Upload core library
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
-          name: desktop-core-linux-x86_64
+          name: ${{ needs.plan.outputs.core }}
           path: ~/core/${{ env.CORE_PKG }}
           compression-level: 0
-          retention-days: 3
+          retention-days: 30
           if-no-files-found: error
 
   app:
     name: desktop app under Xvfb
     needs: [plan, core, backend]
-    # backend is skipped when it isn't asked for or an earlier run built it
+    # core and backend are skipped when an earlier run built them, and backend also when the run doesn't start it
     if: ${{ !cancelled() && !failure() && needs.plan.result == 'success' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: recursive
 
@@ -250,10 +223,12 @@ jobs:
           dpkg-query -W xvfb xdotool openbox imagemagick tesseract-ocr sqlite3 fonts-dejavu-core
 
       - name: Download core library
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
-          name: desktop-core-linux-x86_64
+          name: ${{ needs.plan.outputs.core }}
           path: ~/core
+          run-id: ${{ needs.plan.outputs.core-run || github.run_id }}
+          github-token: ${{ github.token }}
 
       - name: Install core library
         id: core
@@ -261,7 +236,7 @@ jobs:
 
       - name: Download backend
         if: needs.plan.outputs.run-backend == 'true'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: ${{ needs.plan.outputs.backend }}
           path: ~/backend
@@ -281,7 +256,6 @@ jobs:
         with:
           distribution: corretto
           java-version: ${{ env.JAVA_VER }}
-          cache: gradle
 
       - name: Build app
         id: build
@@ -294,6 +268,21 @@ jobs:
           du -sh "$app"
           LD_LIBRARY_PATH="$app/lib/app/resources" ldd "$app/lib/app/resources/libapp-lib.so"
 
+      # for the Claude job; a tarball keeps the app's file modes, which an artifact drops
+      - name: Pack app
+        if: ${{ !cancelled() && steps.build.outcome == 'success' && needs.plan.outputs.run-claude == 'true' }}
+        run: tar -czf "$RUNNER_TEMP/desktop-app.tar.gz" -C apps/multiplatform/release/main/app simplex
+
+      - name: Upload app
+        if: ${{ !cancelled() && steps.build.outcome == 'success' && needs.plan.outputs.run-claude == 'true' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: desktop-app
+          path: ${{ runner.temp }}/desktop-app.tar.gz
+          compression-level: 0
+          retention-days: 1
+          if-no-files-found: error
+
       - name: Run desktop tests
         if: ${{ !cancelled() && steps.build.outcome == 'success' }}
         working-directory: apps/multiplatform
@@ -320,7 +309,7 @@ jobs:
 
       - name: Upload smoke test results
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: desktop-smoke-test
           path: ${{ runner.temp }}/smoke-test
@@ -329,7 +318,7 @@ jobs:
 
       - name: Upload desktop test report
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: desktop-test-report
           path: |
@@ -340,7 +329,7 @@ jobs:
 
       - name: Upload backend logs
         if: ${{ !cancelled() && steps.backend.outcome != 'skipped' }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: desktop-backend-logs
           path: ${{ runner.temp }}/backend/*.log
@@ -352,8 +341,8 @@ jobs:
   # may use the token.
   claude:
     name: Claude tests the desktop app
-    needs: [plan, core, backend]
-    if: ${{ !cancelled() && !failure() && needs.plan.outputs.run-claude == 'true' }}
+    needs: [plan, app]
+    if: ${{ !cancelled() && needs.plan.outputs.run-claude == 'true' && needs.app.result == 'success' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     environment:
@@ -363,14 +352,13 @@ jobs:
       group: desktop-linux-claude-${{ github.ref }}
       cancel-in-progress: true
     env:
-      # the first release with Haiku 5.5's token counts right (2.1.293 added the model, 2.1.296 fixed its counts)
-      CLAUDE_CODE_VERSION: 2.1.296
+      # the same in both app workflows
+      CLAUDE_CODE_VERSION: 2.1.300
       CLAUDE_MODEL: claude-haiku-5-5
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
-          submodules: recursive
           persist-credentials: false
 
       - name: Install tools
@@ -379,18 +367,20 @@ jobs:
           sudo apt-get install -y xvfb xdotool openbox imagemagick tesseract-ocr sqlite3 fonts-dejavu-core
           dpkg-query -W xvfb xdotool openbox imagemagick tesseract-ocr sqlite3 fonts-dejavu-core
 
-      - name: Download core library
-        uses: actions/download-artifact@v7
+      - name: Download app
+        uses: actions/download-artifact@v8
         with:
-          name: desktop-core-linux-x86_64
-          path: ~/core
+          name: desktop-app
+          path: ${{ runner.temp }}
 
-      - name: Install core library
-        run: scripts/ci/desktop-linux/install-core.sh ~/core/${{ env.CORE_PKG }}
+      - name: Unpack app
+        run: |
+          mkdir -p "$RUNNER_TEMP/app"
+          tar -xzf "$RUNNER_TEMP/desktop-app.tar.gz" -C "$RUNNER_TEMP/app"
 
       - name: Download backend
-        if: needs.plan.outputs.run-backend == 'true'
-        uses: actions/download-artifact@v7
+        if: needs.plan.outputs.claude-backend == 'yes'
+        uses: actions/download-artifact@v8
         with:
           name: ${{ needs.plan.outputs.backend }}
           path: ~/backend
@@ -398,21 +388,11 @@ jobs:
           github-token: ${{ github.token }}
 
       - name: Start test backend
-        if: needs.plan.outputs.run-backend == 'true'
+        id: backend
+        if: needs.plan.outputs.claude-backend == 'yes'
         timeout-minutes: 30
         run: scripts/ci/desktop-linux/backend.sh start ~/backend/${{ env.BACKEND_PKG }} "$RUNNER_TEMP/backend"
 
-      - name: Setup Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: corretto
-          java-version: ${{ env.JAVA_VER }}
-          cache: gradle
-
-      - name: Build app
-        working-directory: apps/multiplatform
-        run: ./gradlew --no-daemon --console=plain -Psimplex.assets.dir=../../assets :desktop:createDistributable
-
       # ui goes on every shell's PATH, where Claude's Bash tool finds it whatever environment it builds
       - name: Install Claude Code and the ui command
         run: |
@@ -422,7 +402,7 @@ jobs:
           sudo chmod +x /usr/local/bin/ui
 
       - name: Start the app
-        run: scripts/ci/desktop-linux/smoke-test.sh apps/multiplatform/release/main/app/simplex "$RUNNER_TEMP/claude-test/screens" start
+        run: scripts/ci/desktop-linux/smoke-test.sh "$RUNNER_TEMP/app/simplex" "$RUNNER_TEMP/claude-test/screens" start
 
       # Claude's Bash is limited to single ui commands by the guard hook in claude-test.sh. Claude Code's credential
       # scrub stays off: on Linux it forces its whole Bash sandbox (bubblewrap, socat), which ui isn't set up for.
@@ -438,12 +418,12 @@ jobs:
         run: scripts/ci/desktop-linux/claude-usage.py "$RUNNER_TEMP/claude-transcript.jsonl" "$RUNNER_TEMP/claude-usage.json"
 
       - name: Stop test backend
-        if: ${{ !cancelled() && needs.plan.outputs.run-backend == 'true' }}
+        if: ${{ !cancelled() && steps.backend.outcome != 'skipped' }}
         run: scripts/ci/desktop-linux/backend.sh stop "$RUNNER_TEMP/backend"
 
       - name: Upload Claude test results
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: desktop-claude-test
           path: |
@@ -456,8 +436,8 @@ jobs:
           if-no-files-found: warn
 
       - name: Upload backend logs
-        if: ${{ !cancelled() && needs.plan.outputs.run-backend == 'true' }}
-        uses: actions/upload-artifact@v6
+        if: ${{ !cancelled() && steps.backend.outcome != 'skipped' }}
+        uses: actions/upload-artifact@v7
         with:
           name: desktop-claude-backend-logs
           path: ${{ runner.temp }}/backend/*.log
@@ -468,12 +448,12 @@ jobs:
   release:
     name: released app under Xvfb
     needs: plan
-    if: needs.plan.outputs.run-backend == 'true'
+    if: needs.plan.outputs.run-release == 'true'
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           filter: tree:0
@@ -492,7 +472,7 @@ jobs:
 
       - name: Upload smoke test results
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: desktop-release-smoke-test
           path: ${{ runner.temp }}/smoke-test

.github/workflows/ios-sim.yml

@@ -39,25 +39,55 @@ env:
 
 jobs:
   plan:
-    name: find earlier builds
+    name: choose jobs, find earlier builds
+    # the concurrency group repeats this test, as it can't read job outputs
     if: >-
       github.event_name == 'workflow_dispatch' ||
       contains(github.event.head_commit.message, '[app-ci]') ||
       contains(github.event.head_commit.message, '[app-ci:ios]') ||
       contains(github.event.head_commit.message, '[claude-test]') ||
       contains(github.event.head_commit.message, '[claude-test:ios]')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     outputs:
+      run-claude: ${{ steps.jobs.outputs.claude }}
+      run-backend: ${{ steps.jobs.outputs.backend }}
+      claude-backend: ${{ steps.scope.outputs.backend }}
       core: ${{ steps.names.outputs.core }}
-      backend: ${{ steps.names.outputs.backend }}
       core-run: ${{ steps.core.outputs.run-id }}
+      backend: ${{ steps.names.outputs.backend }}
       backend-run: ${{ steps.backend.outputs.run-id }}
-      claude: ${{ inputs.claude || contains(github.event.head_commit.message, '[claude-test]') || contains(github.event.head_commit.message, '[claude-test:ios]') }}
-      start-backend: ${{ inputs.backend || contains(github.event.head_commit.message, '[ci-backend]') }}
     steps:
+      - name: Choose jobs
+        id: jobs
+        env:
+          CLAUDE: ${{ inputs.claude || contains(github.event.head_commit.message, '[claude-test]') || contains(github.event.head_commit.message, '[claude-test:ios]') }}
+          BACKEND: ${{ inputs.backend || contains(github.event.head_commit.message, '[ci-backend]') }}
+        run: |
+          echo "claude=$CLAUDE" | tee -a "$GITHUB_OUTPUT"
+          echo "backend=$BACKEND" | tee -a "$GITHUB_OUTPUT"
+
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+
+      - name: Claude scope
+        id: scope
+        if: steps.jobs.outputs.claude == 'true'
+        env:
+          BACKEND: ${{ steps.jobs.outputs.backend }}
+        run: |
+          backend=$(sed -n 's/^backend: *//p' scripts/ci/ios-sim/claude-scope)
+          case "$backend" in
+            yes | no) echo "backend=$backend" | tee -a "$GITHUB_OUTPUT" ;;
+            *)
+              echo "::error::claude-scope must say backend: yes or backend: no"
+              exit 1
+              ;;
+          esac
+          if [ "$backend" = yes ] && [ "$BACKEND" != true ]; then
+            echo "::error::claude-scope says the Claude sessions use the test backend: ask for it too"
+            exit 1
+          fi
 
       # artifacts are named after the sources they are built from, so a run uses one that an earlier run uploaded
       - name: Artifact names
@@ -74,6 +104,7 @@ jobs:
 
       - name: Find backend
         id: backend
+        if: steps.jobs.outputs.backend == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
         run: scripts/ci/ios-sim/earlier-run.sh "${{ steps.names.outputs.backend }}"
@@ -82,11 +113,11 @@ jobs:
     name: core library for the iOS simulator
     needs: plan
     if: needs.plan.outputs.core-run == ''
-    runs-on: macos-latest
+    runs-on: macos-26
     timeout-minutes: 240
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Show runner
         run: |
@@ -100,29 +131,12 @@ jobs:
       - name: Use the macOS 26 SDK
         run: scripts/ci/ios-sim/use-macos26-sdk.sh
 
-      # without ~/.cabal, cabal 3.10 keeps its store in XDG directories, not where setup-haskell reports it
-      - name: Use ~/.cabal for cabal
-        run: echo "CABAL_DIR=$HOME/.cabal" >> "$GITHUB_ENV"
-
       - name: Setup Haskell
-        id: haskell
         uses: simplex-chat/setup-haskell-action@v2
         with:
           ghc-version: ${{ env.GHC_VER }}
           cabal-version: ${{ env.CABAL_VER }}
 
-      - name: Restore cabal store
-        id: cabal-cache
-        uses: actions/cache/restore@v4
-        with:
-          path: |
-            ${{ steps.haskell.outputs.cabal-store }}
-            dist-newstyle
-          key: ios-sim-core-store-ghc${{ env.GHC_VER }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}-${{ github.run_id }}
-          restore-keys: |
-            ios-sim-core-store-ghc${{ env.GHC_VER }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}-
-            ios-sim-core-store-ghc${{ env.GHC_VER }}-
-
       - name: Install libraries
         run: brew install openssl@3 libffi gmp
 
@@ -130,20 +144,11 @@ jobs:
         id: build
         run: scripts/ci/ios-sim/build-core.sh ~/Downloads/${{ env.CORE_PKG }}
 
-      - name: Save cabal store
-        if: ${{ !cancelled() }}
-        uses: actions/cache/save@v4
-        with:
-          path: |
-            ${{ steps.haskell.outputs.cabal-store }}
-            dist-newstyle
-          key: ${{ steps.cabal-cache.outputs.cache-primary-key }}
-
       - name: Patch core library for the simulator
         run: scripts/ci/ios-sim/prepare-libs.sh
 
       - name: Upload core library
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ needs.plan.outputs.core }}
           path: ~/Downloads/${{ env.CORE_PKG }}
@@ -154,12 +159,12 @@ jobs:
   backend:
     name: test backend for the app
     needs: plan
-    if: needs.plan.outputs.start-backend == 'true' && needs.plan.outputs.backend-run == ''
-    runs-on: macos-latest
+    if: needs.plan.outputs.run-backend == 'true' && needs.plan.outputs.backend-run == ''
+    runs-on: macos-26
     timeout-minutes: 240
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Show runner
         run: |
@@ -171,42 +176,17 @@ jobs:
       - name: Use the macOS 26 SDK
         run: scripts/ci/ios-sim/use-macos26-sdk.sh
 
-      - name: Use ~/.cabal for cabal
-        run: echo "CABAL_DIR=$HOME/.cabal" >> "$GITHUB_ENV"
-
       - name: Setup Haskell
-        id: haskell
         uses: simplex-chat/setup-haskell-action@v2
         with:
           ghc-version: ${{ env.GHC_VER }}
           cabal-version: ${{ env.CABAL_VER }}
 
-      - name: Restore cabal store
-        id: cabal-cache
-        uses: actions/cache/restore@v4
-        with:
-          path: |
-            ${{ steps.haskell.outputs.cabal-store }}
-            dist-newstyle
-          key: ios-sim-backend-store-ghc${{ env.GHC_VER }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}-${{ github.run_id }}
-          restore-keys: |
-            ios-sim-backend-store-ghc${{ env.GHC_VER }}-${{ hashFiles('cabal.project', 'simplex-chat.cabal') }}-
-            ios-sim-backend-store-ghc${{ env.GHC_VER }}-
-
       - name: Build backend
         run: scripts/ci/ios-sim/build-backend.sh ~/Downloads/${{ env.BACKEND_PKG }}
 
-      - name: Save cabal store
-        if: ${{ !cancelled() }}
-        uses: actions/cache/save@v4
-        with:
-          path: |
-            ${{ steps.haskell.outputs.cabal-store }}
-            dist-newstyle
-          key: ${{ steps.cabal-cache.outputs.cache-primary-key }}
-
       - name: Upload backend
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ needs.plan.outputs.backend }}
           path: ~/Downloads/${{ env.BACKEND_PKG }}
@@ -219,20 +199,13 @@ jobs:
     needs: [plan, core, backend]
     # core and backend are skipped when an earlier run built them, and backend also when the run doesn't start it
     if: ${{ !cancelled() && !failure() && needs.plan.result == 'success' }}
-    runs-on: macos-latest
-    environment:
-      name: ${{ needs.plan.outputs.claude == 'true' && 'app-sim-claude' || '' }}
-      deployment: false
-    timeout-minutes: 330
+    runs-on: macos-26
+    timeout-minutes: 120
     env:
-      CLAUDE_RUN: ${{ needs.plan.outputs.claude }}
-      START_BACKEND: ${{ needs.plan.outputs.start-backend }}
+      START_BACKEND: ${{ needs.plan.outputs.run-backend }}
     steps:
-      # the job later holds the Claude token, so the checkout's GitHub token is not left in .git/config
       - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v6
 
       - name: Show runner
         run: |
@@ -247,7 +220,7 @@ jobs:
         run: scripts/ci/ios-sim/use-macos26-sdk.sh
 
       - name: Download core library
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ needs.plan.outputs.core }}
           path: ~/Downloads
@@ -261,7 +234,7 @@ jobs:
 
       - name: Download backend
         if: env.START_BACKEND == 'true'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ needs.plan.outputs.backend }}
           path: ~/Downloads
@@ -290,37 +263,34 @@ jobs:
             DEVELOPMENT_TEAM= \
             PROVISIONING_PROFILE_SPECIFIER=
 
+      # for the Claude job; a tarball keeps the app's file modes, which an artifact drops
+      - name: Pack app
+        if: needs.plan.outputs.run-claude == 'true'
+        run: tar -czf "$RUNNER_TEMP/SimpleX.app.tar.gz" -C "$RUNNER_TEMP/DerivedData/Build/Products/Debug-iphonesimulator" SimpleX.app
+
+      - name: Upload app
+        if: needs.plan.outputs.run-claude == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: ios-sim-app
+          path: ${{ runner.temp }}/SimpleX.app.tar.gz
+          compression-level: 0
+          retention-days: 1
+          if-no-files-found: error
+
       - name: Install AXe
         run: scripts/ci/ios-sim/install-axe.sh
 
       - name: Run smoke test
         run: scripts/ci/ios-sim/smoke-test.sh "$RUNNER_TEMP/DerivedData/Build/Products/Debug-iphonesimulator/SimpleX.app" "$RUNNER_TEMP/smoke-test"
 
-      - name: Install Claude Code
-        if: env.CLAUDE_RUN == 'true'
-        run: |
-          npm install -g @anthropic-ai/claude-code@2.1.300
-          claude --version
-
-      - name: Run the device test plan with Claude
-        if: env.CLAUDE_RUN == 'true'
-        timeout-minutes: 240
-        env:
-          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          BACKEND_DIR: ${{ env.START_BACKEND == 'true' && format('{0}/backend', runner.temp) || '' }}
-        run: scripts/ci/ios-sim/claude-test.sh "$RUNNER_TEMP/claude-test"
-
-      - name: Report Claude usage
-        if: ${{ always() && env.CLAUDE_RUN == 'true' }}
-        run: scripts/ci/ios-sim/claude-usage.sh "$RUNNER_TEMP/claude-test"
-
       - name: Stop test backend
         if: ${{ !cancelled() && env.START_BACKEND == 'true' }}
         run: scripts/ci/ios-sim/backend.sh stop "$RUNNER_TEMP/backend"
 
       - name: Upload smoke test results
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ios-sim-smoke-test
           path: ${{ runner.temp }}/smoke-test
@@ -329,7 +299,7 @@ jobs:
 
       - name: Upload backend logs
         if: ${{ !cancelled() && env.START_BACKEND == 'true' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ios-sim-backend-logs
           path: |
@@ -338,11 +308,104 @@ jobs:
           retention-days: 3
           if-no-files-found: warn
 
+  # The app-sim-claude environment's branch rule decides which branches may use the token.
+  claude:
+    name: Claude tests the iOS app
+    needs: [plan, app]
+    if: ${{ !cancelled() && needs.plan.outputs.run-claude == 'true' && needs.app.result == 'success' }}
+    runs-on: macos-26
+    timeout-minutes: 330
+    environment:
+      name: app-sim-claude
+      deployment: false
+    concurrency:
+      group: ios-sim-claude-${{ github.ref }}
+      cancel-in-progress: true
+    env:
+      # the same in both app workflows
+      CLAUDE_CODE_VERSION: 2.1.300
+    steps:
+      # the job holds the Claude token, so the checkout's GitHub token is not left in .git/config
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Show runner
+        run: |
+          sw_vers
+          xcodebuild -version
+          xcrun simctl list runtimes
+
+      - name: Use the macOS 26 SDK
+        run: scripts/ci/ios-sim/use-macos26-sdk.sh
+
+      - name: Download app
+        uses: actions/download-artifact@v8
+        with:
+          name: ios-sim-app
+          path: ${{ runner.temp }}
+
+      - name: Unpack app
+        run: tar -xzf "$RUNNER_TEMP/SimpleX.app.tar.gz" -C "$RUNNER_TEMP"
+
+      - name: Download backend
+        if: needs.plan.outputs.claude-backend == 'yes'
+        uses: actions/download-artifact@v8
+        with:
+          name: ${{ needs.plan.outputs.backend }}
+          path: ~/Downloads
+          run-id: ${{ needs.plan.outputs.backend-run || github.run_id }}
+          github-token: ${{ github.token }}
+
+      - name: Start test backend
+        id: backend
+        if: needs.plan.outputs.claude-backend == 'yes'
+        timeout-minutes: 30
+        run: scripts/ci/ios-sim/backend.sh start ~/Downloads/${{ env.BACKEND_PKG }} "$RUNNER_TEMP/backend"
+
+      - name: Install AXe
+        run: scripts/ci/ios-sim/install-axe.sh
+
+      - name: Run smoke test
+        run: scripts/ci/ios-sim/smoke-test.sh "$RUNNER_TEMP/SimpleX.app" "$RUNNER_TEMP/claude-test/smoke-test"
+
+      - name: Install Claude Code
+        run: |
+          npm install -g "@anthropic-ai/claude-code@$CLAUDE_CODE_VERSION"
+          claude --version
+
+      - name: Run the device test plan with Claude
+        timeout-minutes: 240
+        env:
+          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          BACKEND_DIR: ${{ steps.backend.outcome == 'success' && format('{0}/backend', runner.temp) || '' }}
+        run: scripts/ci/ios-sim/claude-test.sh "$RUNNER_TEMP/claude-test"
+
+      - name: Report Claude usage
+        if: ${{ always() }}
+        run: scripts/ci/ios-sim/claude-usage.sh "$RUNNER_TEMP/claude-test"
+
+      - name: Stop test backend
+        if: ${{ !cancelled() && steps.backend.outcome != 'skipped' }}
+        run: scripts/ci/ios-sim/backend.sh stop "$RUNNER_TEMP/backend"
+
       - name: Upload Claude test results
-        if: ${{ always() && env.CLAUDE_RUN == 'true' }}
-        uses: actions/upload-artifact@v4
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
         with:
           name: ios-sim-claude-test
           path: ${{ runner.temp }}/claude-test
           retention-days: 14
           if-no-files-found: warn
+
+      - name: Upload backend logs
+        if: ${{ !cancelled() && steps.backend.outcome != 'skipped' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: ios-sim-claude-backend-logs
+          path: |
+            ${{ runner.temp }}/backend/*.log
+            ${{ runner.temp }}/backend/seed.md
+          retention-days: 3
+          if-no-files-found: warn