From 1dd0144d5b1276f04cc22554bef9338671a7d756 Mon Sep 17 00:00:00 2001 From: Doug Mealing Date: Wed, 28 Oct 2026 20:12:38 -0400 Subject: [PATCH 1/7] ci: run the touched ports' tests on pull requests; record first call on paid work for port co-maintainers --- .github/workflows/pr-ci.yml | 189 ++++++++++++++++++++++++++++++++++++ CONTRIBUTING.md | 18 ++-- GOVERNANCE.md | 5 + 3 files changed, 205 insertions(+), 7 deletions(-) create mode 100644 .github/workflows/pr-ci.yml diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml new file mode 100644 index 000000000..f82b8ed73 --- /dev/null +++ b/.github/workflows/pr-ci.yml @@ -0,0 +1,189 @@ +name: pr-ci + +# PR CI: runs the tests of the ports a pull request touches, on GitHub-hosted runners +# (free for a public repo). hygiene.yml still owns the `leak-scan` status; this workflow +# adds the port lanes that used to run only on main, nightly and release tags. +# +# THIN WRAPPER: scripts/ci-local.sh is the single definition of every check here. Each +# job installs the toolchain its lane needs and calls the script with that lane's +# `--only` selector and `--no-integration`, so a local run is the same check. Change a +# check in the script, never here. +# +# WHICH PORTS: `detect` maps the PR's changed paths to ports with +# scripts/ci-affected-ports.sh, the same mapper local-ci.yml uses. A change under a +# port's directory selects that port; a change to fixtures/, spec/, scripts/, .github/ +# or anything unrecognised selects ALL ports (the mapper fails open); a docs-only change +# selects none and runs only the offline `gates` lane. +# +# WHAT RUNS PER PORT: unit tests plus the conformance corpora, not the docker +# integration suites (integration-tests.yml owns those, on tags and on demand): +# ts — ts-fast (build + typecheck, conformance, completeness) and ts-unit +# (the per-package suites) +# java — java-fast (java + kotlin conformance) and java-slow (the full reactor +# build with tests on) +# python / csharp — the port's full test suite and conformance +# +# THE REQUIRED CHECK: the final job, `pr-ci`, is the one name to make a required check. +# It always runs and is green only when every lane that was selected passed, so the +# set of lanes can change per PR without touching branch protection. Do not rename it. +# +# SECURITY: this is a `pull_request` workflow on GitHub-hosted runners with a read-only +# token and no secrets, so fork-submitted code cannot reach anything. It must NEVER move +# onto the self-hosted runner (see local-ci.yml, which must never gain this trigger). + +on: + pull_request: + +permissions: + contents: read + +# A new push to a PR cancels the superseded run. +concurrency: + group: pr-ci-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + detect: + runs-on: ubuntu-latest + outputs: + ports: ${{ steps.sel.outputs.ports }} + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + persist-credentials: false + - id: sel + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + run: | + # HEAD is the PR's merge commit, so base..HEAD is exactly the PR's change. + ports="$(scripts/ci-affected-ports.sh "$BASE_SHA" HEAD)" + echo "selected ports: '$ports'" + echo "ports=$ports" >> "$GITHUB_OUTPUT" + + gates: + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 # the version gates diff against origin/main + persist-credentials: false + - uses: oven-sh/setup-bun@v2 + with: + bun-version: '1.3.14' + - name: Cache Bun install cache + uses: actions/cache@v4 + with: + path: ~/.bun/install/cache + key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }} + restore-keys: | + ${{ runner.os }}-bun- + - run: scripts/ci-local.sh --only gates --strict-toolchains + + ts: + needs: detect + if: contains(needs.detect.outputs.ports, 'ts') + runs-on: ubuntu-latest + timeout-minutes: 40 + strategy: + fail-fast: false + matrix: + lane: [ts-fast, ts-unit] + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: oven-sh/setup-bun@v2 + with: + bun-version: '1.3.14' + - name: Cache Bun install cache + uses: actions/cache@v4 + with: + path: ~/.bun/install/cache + key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }} + restore-keys: | + ${{ runner.os }}-bun- + - name: ${{ matrix.lane }} + env: + LANE: ${{ matrix.lane }} + run: scripts/ci-local.sh --only "$LANE" --no-integration --strict-toolchains + + java: + needs: detect + if: contains(needs.detect.outputs.ports, 'java') + runs-on: ubuntu-latest + timeout-minutes: 45 + strategy: + fail-fast: false + matrix: + # java-fast = java + kotlin conformance; java-slow = the full reactor, tests on. + lane: [java-fast, java-slow] + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '21' + cache: maven + - name: ${{ matrix.lane }} + env: + LANE: ${{ matrix.lane }} + run: | + METAOBJECTS_CI_M2_REPO="$HOME/.m2/repository" \ + scripts/ci-local.sh --only "$LANE" --no-integration --strict-toolchains + + python: + needs: detect + if: contains(needs.detect.outputs.ports, 'python') + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: astral-sh/setup-uv@v3 + with: + enable-cache: true + - run: scripts/ci-local.sh --only python --no-integration --strict-toolchains + + csharp: + needs: detect + if: contains(needs.detect.outputs.ports, 'csharp') + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: actions/setup-dotnet@v4 + with: + dotnet-version: '8.0.x' + - name: Cache NuGet packages + uses: actions/cache@v4 + with: + path: ~/.nuget/packages + key: ${{ runner.os }}-nuget-${{ hashFiles('server/csharp/**/*.csproj') }} + restore-keys: | + ${{ runner.os }}-nuget- + - run: scripts/ci-local.sh --only csharp --no-integration --strict-toolchains + + # The stable required-check name. Runs even when lanes are skipped or failed. + pr-ci: + if: always() + needs: [detect, gates, ts, java, python, csharp] + runs-on: ubuntu-latest + steps: + - name: Every selected lane passed + env: + RESULTS: ${{ join(needs.*.result, ' ') }} + run: | + echo "lane results: $RESULTS" + for r in $RESULTS; do + case "$r" in + success|skipped) ;; + *) echo "a lane finished '$r'" >&2; exit 1 ;; + esac + done diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 55dd7647f..a4f7db87b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -28,10 +28,10 @@ conformance corpora. This guide covers how to propose changes. 1. **Fork** the repo and create a branch from `main`. 2. Make your change following the discipline below — **tests first (TDD)**. 3. Run the gates locally with **`scripts/ci-local.sh --quick`** and make sure it's - green. **This matters:** on a pull request GitHub Actions runs only the leak scan - (`hygiene.yml`); the conformance and integration lanes run on `main`, nightly and on - release tags, so your local run is the only check of the rest before merge — see the - *Local CI* section below. + green. On a pull request GitHub Actions runs the leak scan (`hygiene.yml`) and the + unit and conformance tests of the ports your change touches (`pr-ci.yml`); the docker + integration suites run on `main`, nightly and on release tags — see the *Local CI* + section below. 4. Open a **pull request** against `main` and fill out the PR template. 5. A maintainer reviews the change and the checks on the pull request before merge. Who can approve what, and which changes need a core maintainer, is in @@ -84,9 +84,13 @@ GitHub Actions is enabled on this repository. The check workflows in `.github/workflows/` are thin wrappers over `scripts/ci-local.sh`, the single definition of the checks: each wrapper checks out, installs the toolchains its lane needs, and calls the script, so a local run is the same check a workflow -run would be. A pull request runs only the leak scan; the other lanes run on -`main`, nightly and on release tags. Run the script locally before opening or -merging a PR, so nothing red reaches `main`: +run would be. A pull request runs the leak scan (`hygiene.yml`) and `pr-ci.yml`, which +runs the unit tests and conformance corpora of only the ports the PR touches (a change +under `fixtures/`, `spec/`, `scripts/` or `.github/` touches every port; a docs-only change +runs just the offline gates). Its `pr-ci` job is green only when every selected lane is, +and a newer push cancels the superseded run. The docker integration suites run on `main`, +nightly and on release tags. Run the script locally before opening or merging a PR, so +nothing red reaches `main`: ```bash scripts/ci-local.sh # full parity: hygiene.yml's leak-scan, all-port diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 2d1f493a0..755de01b6 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -131,6 +131,11 @@ license does not grant use of the MetaObjects name or trademark. Paid work or sponsorship does not grant a role, a vote or an exception to review. A change built for a paying customer goes through the same review as any other change. +One commitment goes with the roles: a co-maintainer who owns a port gets first call on paid work +in that port. When the creator or Doug Mealing LLC has paid work that falls in a port, they offer it +to that port's co-maintainer before anyone else. This is an offer of work only. It grants no role, +vote or review exception, and the co-maintainer may decline it. + ## Succession The creator has stepped away when they say so in writing, or when they have not committed, From 91dad80d2514ede67d5cfad621f3857f32fc0ca1 Mon Sep 17 00:00:00 2001 From: Doug Mealing Date: Wed, 28 Oct 2026 22:51:53 -0400 Subject: [PATCH 2/7] ci: address review of pr-ci (exact base, java reactor only, leak base, exact port match, docs) --- .github/workflows/conformance.yml | 2 +- .github/workflows/pr-ci.yml | 32 +++++++++++++++++-------------- CONTRIBUTING.md | 5 +++-- GOVERNANCE.md | 9 +++++---- scripts/ci-local.sh | 3 ++- 5 files changed, 29 insertions(+), 22 deletions(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index a0017d87f..fd52ba123 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -1,7 +1,7 @@ name: conformance # COST: the cross-port conformance matrix + full Java reactor + drift/mutation gates -# are heavy, so they do NOT run on every push/PR — release gate (tag `v*`), a NIGHTLY +# are heavy, so they do NOT run on every push or PR (pr-ci.yml runs the touched ports' lanes on a PR) — release gate (tag `v*`), a NIGHTLY # schedule, and on-demand (workflow_dispatch). Run them LOCALLY before opening/merging # a PR: # scripts/ci-local.sh # full parity (this + integration suite + drift) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index f82b8ed73..a80737d7a 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -19,12 +19,12 @@ name: pr-ci # integration suites (integration-tests.yml owns those, on tags and on demand): # ts — ts-fast (build + typecheck, conformance, completeness) and ts-unit # (the per-package suites) -# java — java-fast (java + kotlin conformance) and java-slow (the full reactor -# build with tests on) +# java — java-slow: the full reactor build with tests on, which already holds the +# java and kotlin conformance classes # python / csharp — the port's full test suite and conformance # -# THE REQUIRED CHECK: the final job, `pr-ci`, is the one name to make a required check. -# It always runs and is green only when every lane that was selected passed, so the +# THE REQUIRED CHECK: the final job, `pr-ci`, is the name to put in branch protection +# when a maintainer decides to (it is not required yet; `leak-scan` is). It always runs and is green only when every lane that was selected passed, so the # set of lanes can change per PR without touching branch protection. Do not rename it. # # SECURITY: this is a `pull_request` workflow on GitHub-hosted runners with a read-only @@ -54,10 +54,10 @@ jobs: persist-credentials: false - id: sel env: - BASE_SHA: ${{ github.event.pull_request.base.sha }} run: | - # HEAD is the PR's merge commit, so base..HEAD is exactly the PR's change. - ports="$(scripts/ci-affected-ports.sh "$BASE_SHA" HEAD)" + # HEAD is the PR's merge commit; its first parent is the base tip the merge was + # built on, so HEAD^1..HEAD is exactly the PR's change even after main moves. + ports="$(scripts/ci-affected-ports.sh HEAD^1 HEAD)" echo "selected ports: '$ports'" echo "ports=$ports" >> "$GITHUB_OUTPUT" @@ -79,11 +79,14 @@ jobs: key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }} restore-keys: | ${{ runner.os }}-bun- - - run: scripts/ci-local.sh --only gates --strict-toolchains + - name: Gates + env: + MO_CI_LEAK_BASE: origin/${{ github.base_ref }} + run: scripts/ci-local.sh --only gates --strict-toolchains ts: needs: detect - if: contains(needs.detect.outputs.ports, 'ts') + if: contains(format(' {0} ', needs.detect.outputs.ports), ' ts ') runs-on: ubuntu-latest timeout-minutes: 40 strategy: @@ -111,14 +114,15 @@ jobs: java: needs: detect - if: contains(needs.detect.outputs.ports, 'java') + if: contains(format(' {0} ', needs.detect.outputs.ports), ' java ') runs-on: ubuntu-latest timeout-minutes: 45 strategy: fail-fast: false matrix: - # java-fast = java + kotlin conformance; java-slow = the full reactor, tests on. - lane: [java-fast, java-slow] + # java-slow = the full reactor with tests on, which already holds every java and + # kotlin conformance class (java-fast would run the same classes a second time). + lane: [java-slow] steps: - uses: actions/checkout@v4 with: @@ -137,7 +141,7 @@ jobs: python: needs: detect - if: contains(needs.detect.outputs.ports, 'python') + if: contains(format(' {0} ', needs.detect.outputs.ports), ' python ') runs-on: ubuntu-latest timeout-minutes: 30 steps: @@ -151,7 +155,7 @@ jobs: csharp: needs: detect - if: contains(needs.detect.outputs.ports, 'csharp') + if: contains(format(' {0} ', needs.detect.outputs.ports), ' csharp ') runs-on: ubuntu-latest timeout-minutes: 30 steps: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a4f7db87b..2a710bd57 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -86,8 +86,9 @@ definition of the checks: each wrapper checks out, installs the toolchains its lane needs, and calls the script, so a local run is the same check a workflow run would be. A pull request runs the leak scan (`hygiene.yml`) and `pr-ci.yml`, which runs the unit tests and conformance corpora of only the ports the PR touches (a change -under `fixtures/`, `spec/`, `scripts/` or `.github/` touches every port; a docs-only change -runs just the offline gates). Its `pr-ci` job is green only when every selected lane is, +under `fixtures/`, `spec/`, `scripts/` or `.github/`, or to any file outside a port's +directory that the selector does not recognise, touches every port; a change to `docs/` or +Markdown files runs just the offline gates). Its `pr-ci` job is green only when every selected lane is, and a newer push cancels the superseded run. The docker integration suites run on `main`, nightly and on release tags. Run the script locally before opening or merging a PR, so nothing red reaches `main`: diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 755de01b6..32fae092d 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -131,10 +131,11 @@ license does not grant use of the MetaObjects name or trademark. Paid work or sponsorship does not grant a role, a vote or an exception to review. A change built for a paying customer goes through the same review as any other change. -One commitment goes with the roles: a co-maintainer who owns a port gets first call on paid work -in that port. When the creator or Doug Mealing LLC has paid work that falls in a port, they offer it -to that port's co-maintainer before anyone else. This is an offer of work only. It grants no role, -vote or review exception, and the co-maintainer may decline it. +One commitment goes with the roles: a port maintainer gets first call on paid work in the port +they maintain, as listed in [MAINTAINERS.md](MAINTAINERS.md). When the creator or Doug Mealing LLC +has paid work that falls in a port, they offer it to that port's maintainer before anyone else; work +that spans several ports is offered to each of those ports' maintainers. This is an offer of work +only. It grants no role, vote or review exception, and the maintainer may decline it. ## Succession diff --git a/scripts/ci-local.sh b/scripts/ci-local.sh index 097b89fed..11b50b23e 100755 --- a/scripts/ci-local.sh +++ b/scripts/ci-local.sh @@ -118,7 +118,8 @@ # so use it wherever a skip would mean a real gap rather than an absent toolchain: # the pre-release run, and the no-mistakes gate's two commands (.no-mistakes.yaml). # -# Called by: hygiene.yml (--only leak-scan) · conformance.yml (--only gates / +# Called by: hygiene.yml (--only leak-scan) · pr-ci.yml (the touched ports' lanes, with +# --no-integration) · conformance.yml (--only gates / # ts-fast / csharp / java-fast / python, and java-slow for the reactor, all with # --no-integration) · integration-tests.yml (--integration-only, one job per lane) · # local-ci.yml (one job per lane). From 06947755bd1ae5dda96a6edcd6967127448a4449 Mon Sep 17 00:00:00 2001 From: Doug Mealing Date: Wed, 28 Oct 2026 22:53:21 -0400 Subject: [PATCH 3/7] no-mistakes(review): apply reviewer inline fixes --- .github/workflows/pr-ci.yml | 4 ++-- CONTRIBUTING.md | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index a80737d7a..14825e5d1 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -11,8 +11,8 @@ name: pr-ci # # WHICH PORTS: `detect` maps the PR's changed paths to ports with # scripts/ci-affected-ports.sh, the same mapper local-ci.yml uses. A change under a -# port's directory selects that port; a change to fixtures/, spec/, scripts/, .github/ -# or anything unrecognised selects ALL ports (the mapper fails open); a docs-only change +# port's directory selects that port; a change to fixtures/, spec/, scripts/, .github/, +# agent-context/ or anything unrecognised selects ALL ports (the mapper fails open); a docs-only change # selects none and runs only the offline `gates` lane. # # WHAT RUNS PER PORT: unit tests plus the conformance corpora, not the docker diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2a710bd57..7bfcf78a0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -86,9 +86,9 @@ definition of the checks: each wrapper checks out, installs the toolchains its lane needs, and calls the script, so a local run is the same check a workflow run would be. A pull request runs the leak scan (`hygiene.yml`) and `pr-ci.yml`, which runs the unit tests and conformance corpora of only the ports the PR touches (a change -under `fixtures/`, `spec/`, `scripts/` or `.github/`, or to any file outside a port's -directory that the selector does not recognise, touches every port; a change to `docs/` or -Markdown files runs just the offline gates). Its `pr-ci` job is green only when every selected lane is, +under `fixtures/`, `spec/`, `scripts/`, `.github/` or `agent-context/`, or to any file outside a +port's directory that the selector does not recognise, touches every port; a change only to +`docs/` or to Markdown files outside those directories runs just the offline gates). Its `pr-ci` job is green only when every selected lane is, and a newer push cancels the superseded run. The docker integration suites run on `main`, nightly and on release tags. Run the script locally before opening or merging a PR, so nothing red reaches `main`: From f76c20976c6c6162950cab594460d76198e6080a Mon Sep 17 00:00:00 2001 From: Doug Mealing Date: Wed, 28 Oct 2026 22:54:16 -0400 Subject: [PATCH 4/7] no-mistakes(review): Remove empty env key from pr-ci sel step --- .github/workflows/pr-ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 14825e5d1..d405b38e1 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -53,7 +53,6 @@ jobs: fetch-depth: 0 persist-credentials: false - id: sel - env: run: | # HEAD is the PR's merge commit; its first parent is the base tip the merge was # built on, so HEAD^1..HEAD is exactly the PR's change even after main moves. From 33ac84184d20a61df6062e04449ba6b804fdef3c Mon Sep 17 00:00:00 2001 From: Doug Mealing Date: Wed, 28 Oct 2026 23:10:49 -0400 Subject: [PATCH 5/7] no-mistakes(document): Rewrapped CONTRIBUTING.md PR-CI paragraph; no stale facts left --- CONTRIBUTING.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 7bfcf78a0..3809b8490 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -86,12 +86,13 @@ definition of the checks: each wrapper checks out, installs the toolchains its lane needs, and calls the script, so a local run is the same check a workflow run would be. A pull request runs the leak scan (`hygiene.yml`) and `pr-ci.yml`, which runs the unit tests and conformance corpora of only the ports the PR touches (a change -under `fixtures/`, `spec/`, `scripts/`, `.github/` or `agent-context/`, or to any file outside a -port's directory that the selector does not recognise, touches every port; a change only to -`docs/` or to Markdown files outside those directories runs just the offline gates). Its `pr-ci` job is green only when every selected lane is, -and a newer push cancels the superseded run. The docker integration suites run on `main`, -nightly and on release tags. Run the script locally before opening or merging a PR, so -nothing red reaches `main`: +under `fixtures/`, `spec/`, `scripts/`, `.github/` or `agent-context/`, or to any file +outside a port's directory that the selector does not recognise, touches every port; a +change only to `docs/` or to Markdown files outside those directories runs just the +offline gates). Its `pr-ci` job is green only when every selected lane is, and a newer +push cancels the superseded run. The docker integration suites run on `main`, nightly and +on release tags. Run the script locally before opening or merging a PR, so nothing red +reaches `main`: ```bash scripts/ci-local.sh # full parity: hygiene.yml's leak-scan, all-port From 797c5b38a15cb4701e3ef800e3d62a41587b293e Mon Sep 17 00:00:00 2001 From: Doug Mealing Date: Thu, 29 Oct 2026 22:48:13 -0400 Subject: [PATCH 6/7] no-mistakes(review): Raise pr-ci ts job timeout to 60 minutes --- .github/workflows/pr-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index d405b38e1..54aa683cb 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -87,7 +87,7 @@ jobs: needs: detect if: contains(format(' {0} ', needs.detect.outputs.ports), ' ts ') runs-on: ubuntu-latest - timeout-minutes: 40 + timeout-minutes: 60 strategy: fail-fast: false matrix: From 030e50454abf35f8e7211d697afbd0d0017b2d76 Mon Sep 17 00:00:00 2001 From: Doug Mealing Date: Thu, 29 Oct 2026 23:16:10 -0400 Subject: [PATCH 7/7] no-mistakes(document): Fixed stale PR CI docs: integration suite trigger wrong in CONTRIBUTING.md; overlong workflow comments reflowed. GOVERNANCE.md paid-work commitment checked, accurate. --- .github/workflows/conformance.yml | 5 +++-- .github/workflows/pr-ci.yml | 9 +++++---- CONTRIBUTING.md | 6 +++--- 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index fd52ba123..e610f455d 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -1,8 +1,9 @@ name: conformance # COST: the cross-port conformance matrix + full Java reactor + drift/mutation gates -# are heavy, so they do NOT run on every push or PR (pr-ci.yml runs the touched ports' lanes on a PR) — release gate (tag `v*`), a NIGHTLY -# schedule, and on-demand (workflow_dispatch). Run them LOCALLY before opening/merging +# are heavy, so they do NOT run on every push or PR (pr-ci.yml runs the touched ports' +# lanes on a PR) — release gate (tag `v*`), a NIGHTLY schedule, and on-demand +# (workflow_dispatch). Run them LOCALLY before opening/merging # a PR: # scripts/ci-local.sh # full parity (this + integration suite + drift) # scripts/ci-local.sh --quick # everything except the docker integration suite diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 54aa683cb..c1467e937 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -12,8 +12,8 @@ name: pr-ci # WHICH PORTS: `detect` maps the PR's changed paths to ports with # scripts/ci-affected-ports.sh, the same mapper local-ci.yml uses. A change under a # port's directory selects that port; a change to fixtures/, spec/, scripts/, .github/, -# agent-context/ or anything unrecognised selects ALL ports (the mapper fails open); a docs-only change -# selects none and runs only the offline `gates` lane. +# agent-context/ or anything unrecognised selects ALL ports (the mapper fails open); a +# docs-only change selects none and runs only the offline `gates` lane. # # WHAT RUNS PER PORT: unit tests plus the conformance corpora, not the docker # integration suites (integration-tests.yml owns those, on tags and on demand): @@ -24,8 +24,9 @@ name: pr-ci # python / csharp — the port's full test suite and conformance # # THE REQUIRED CHECK: the final job, `pr-ci`, is the name to put in branch protection -# when a maintainer decides to (it is not required yet; `leak-scan` is). It always runs and is green only when every lane that was selected passed, so the -# set of lanes can change per PR without touching branch protection. Do not rename it. +# when a maintainer decides to (it is not required yet; `leak-scan` is). It always runs +# and is green only when every lane that was selected passed, so the set of lanes can +# change per PR without touching branch protection. Do not rename it. # # SECURITY: this is a `pull_request` workflow on GitHub-hosted runners with a read-only # token and no secrets, so fork-submitted code cannot reach anything. It must NEVER move diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3809b8490..709cb8c33 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -30,7 +30,7 @@ conformance corpora. This guide covers how to propose changes. 3. Run the gates locally with **`scripts/ci-local.sh --quick`** and make sure it's green. On a pull request GitHub Actions runs the leak scan (`hygiene.yml`) and the unit and conformance tests of the ports your change touches (`pr-ci.yml`); the docker - integration suites run on `main`, nightly and on release tags — see the *Local CI* + integration suites run on release tags and on manual dispatch — see the *Local CI* section below. 4. Open a **pull request** against `main` and fill out the PR template. 5. A maintainer reviews the change and the checks on the pull request before merge. Who can @@ -90,8 +90,8 @@ under `fixtures/`, `spec/`, `scripts/`, `.github/` or `agent-context/`, or to an outside a port's directory that the selector does not recognise, touches every port; a change only to `docs/` or to Markdown files outside those directories runs just the offline gates). Its `pr-ci` job is green only when every selected lane is, and a newer -push cancels the superseded run. The docker integration suites run on `main`, nightly and -on release tags. Run the script locally before opening or merging a PR, so nothing red +push cancels the superseded run. The docker integration suites run on release tags and on +manual dispatch. Run the script locally before opening or merging a PR, so nothing red reaches `main`: ```bash