Hardening CI for prisma and convex deploy

.github/workflows/ci-cd-web-desktop.yml

@@ -227,6 +227,8 @@ jobs:
             ${{ runner.os }}-nextjs-${{ hashFiles('pnpm-lock.yaml', 'bun.lock') }}-
 
       - name: Install and build (Next.js)
+        env:
+          PRISMA_ENGINES_CHECKSUM_IGNORE_MISSING: "1"
         run: |
           cd "$EFFECTIVE_APP_DIR"
           bun install --frozen-lockfile --filter '!appsdesktop'
@@ -485,7 +487,8 @@ jobs:
             -e MACHINE_PROVISIONING_SECRET \
             -e MACHINE_TOKEN_TTL_MS \
             -e FLEET_SYNC_SECRET \
-            node:20-bullseye bash -lc "set -euo pipefail; curl -fsSL https://bun.sh/install | bash >/tmp/bun-install.log; export BUN_INSTALL=\"\${BUN_INSTALL:-/root/.bun}\"; export PATH=\"\$BUN_INSTALL/bin:\$PATH\"; bun install --frozen-lockfile; \
+            -e CONVEX_TMPDIR=/app/convex/_generated/tmp \
+            node:20-bullseye bash -lc "set -euo pipefail; curl -fsSL https://bun.sh/install | bash >/tmp/bun-install.log; export BUN_INSTALL=\"\${BUN_INSTALL:-/root/.bun}\"; export PATH=\"\$BUN_INSTALL/bin:\$PATH\"; export CONVEX_TMPDIR=/app/convex/_generated/tmp; bun install --frozen-lockfile; \
               if [ -n \"$MACHINE_PROVISIONING_SECRET\" ]; then bunx convex env set MACHINE_PROVISIONING_SECRET \"$MACHINE_PROVISIONING_SECRET\"; fi; \
               if [ -n \"$MACHINE_TOKEN_TTL_MS\" ]; then bunx convex env set MACHINE_TOKEN_TTL_MS \"$MACHINE_TOKEN_TTL_MS\"; fi; \
               if [ -n \"$FLEET_SYNC_SECRET\" ]; then bunx convex env set FLEET_SYNC_SECRET \"$FLEET_SYNC_SECRET\"; fi; \
@@ -498,6 +501,7 @@ jobs:
             echo "Renaming .env -> .env.bak (Convex self-hosted deploy)"
             mv -f .env .env.bak
           fi
+          mkdir -p convex/_generated/tmp
       - name: Deploy functions to Convex self-hosted
         env:
           CONVEX_SELF_HOSTED_URL: https://convex.esdrasrenan.com.br
@@ -509,7 +513,8 @@ jobs:
             -e CI=true \
             -e CONVEX_SELF_HOSTED_URL \
             -e CONVEX_SELF_HOSTED_ADMIN_KEY \
-            node:20-bullseye bash -lc "set -euo pipefail; curl -fsSL https://bun.sh/install | bash >/tmp/bun-install.log; export BUN_INSTALL=\"\${BUN_INSTALL:-/root/.bun}\"; export PATH=\"\$BUN_INSTALL/bin:\$PATH\"; bun install --frozen-lockfile; bunx convex deploy"
+            -e CONVEX_TMPDIR=/app/convex/_generated/tmp \
+            node:20-bullseye bash -lc "set -euo pipefail; curl -fsSL https://bun.sh/install | bash >/tmp/bun-install.log; export BUN_INSTALL=\"\${BUN_INSTALL:-/root/.bun}\"; export PATH=\"\$BUN_INSTALL/bin:\$PATH\"; export CONVEX_TMPDIR=/app/convex/_generated/tmp; bun install --frozen-lockfile; bunx convex deploy"
 
       - name: Cleanup old convex build workdirs (keep last 2)
         run: |

.github/workflows/quality-checks.yml

@@ -48,6 +48,8 @@ jobs:
             ${{ runner.os }}-nextjs-${{ hashFiles('pnpm-lock.yaml', 'bun.lock') }}-
 
       - name: Generate Prisma client
+        env:
+          PRISMA_ENGINES_CHECKSUM_IGNORE_MISSING: "1"
         run: bun run prisma:generate
 
       - name: Lint