ci: diff-plan main pushes and run the full candidate matrix on release tags - #228
Merged
Merged
Conversation
…pushes Main pushes now plan from the pushed diff like pull requests, so untouched surfaces skip their jobs. Release tags trigger a full CI run whose artifacts the release workflow consumes; the tag workflow pins to that run and waits for it. The image job derives the release version from the previous tag when building a tag, since the tag itself has no commits after it.
The race suite duplicated the backend suite on every backend change. One -race -cover run keeps both signals at the cost of the slower run alone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The full 19-job CI matrix ran on every push to
main(~25 min wall, including the 22-minute Android candidate), regardless of what changed. Releases, meanwhile, are rare. This PR moves that cost to where it is actually consumed:plannow computes affected surfaces from the pushed diff, exactly like pull requests. A backend-only push runs backend/security/image and skips Android, marketing, docs, CLI, and n8n; a docs-only push runs the docs suite only. Delivery-surface changes (workflows,changes/, build contracts) still fail closed to the complete matrix.v*tags now trigger CI, producing the candidate artifacts (frontend bundle, unsigned APK, image evidence) for the tagged SHA.gh run watch --exit-status) instead of picking any successful run for the SHA — necessary now that a SHA can have both a diff-planned main run and a full tag run, and safer generally: a red tag build can no longer release.-race -coverinstead of two separate jobs duplicating the suite (saves ~11 runner-minutes per backend change; coverage is still produced).The image job's manifest derivation handles tag runs by ranging from the previous release tag (
git describe), since a tag has no commits after itself — the changelog-derived version resolution would otherwise fail on an empty commit range.Verification
bun test scripts/release-ci-contract.test.mjs scripts/ci-plan.test.mjs scripts/ci-artifacts.test.mjs— 16/16 pass, including "main candidates always run the complete matrix" and "delivery changes fail closed."yaml.safe_load).scripts/ci-plan.mjsexercised in both modes:--fulland diff-based, plus a synthetic classification check (backend-only→ backend/security/image/application,docs-only→ documentation).Risks: tag-pushed CI runs are new — release flow now takes CI duration longer at tag time (acceptable; releases are infrequent). Android artifact freshness at release time is preserved by the tag run building it.