diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6d96e66..50653ab 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,7 +4,9 @@ name: CI # the longer steps are scripts under scripts/checks/ with the comments they had here. Two jobs, both # required by branch protection under their names: `Runner ()` runs every step but the release # ones on Linux and macOS, and `Release contents` runs the release steps with the exact toolchain -# release.yml names. +# release.yml names. On a pull request the `Runner` jobs run only the steps jpdev.json maps the +# changed paths to (`check.sh --changed`); on a push to main, and when release.yml calls this +# workflow at a tag, they run the whole list. `Release contents` runs its four steps every time. on: pull_request: @@ -26,7 +28,10 @@ jobs: matrix: os: [ubuntu-latest, macos-latest] steps: + # The whole history, so that --changed finds the merge base with the base branch. - uses: actions/checkout@v4 + with: + fetch-depth: 0 # First, so that a manifest that does not parse fails before the long steps start. - name: The manifest parses and its first step runs run: scripts/dev/check.sh --manifest dev.json --only local-paths @@ -36,8 +41,20 @@ jobs: cache: true # The pinned Runtimes, the ownership-era Runner and the Gateway are checked out and built by # the build-pinned step (scripts/checks/build-pinned.sh). + # A pull request runs the steps jpdev.json maps its changed paths to, and the whole list when + # a path is unmapped or the mapping, dev.json or the runner changed. A push to main runs the + # whole list, and only that run is what a release is held to. The release steps are skipped + # here either way: `Release contents` runs them. - name: Checks - run: scripts/dev/check.sh --all --skip release-toolchain,third-party-notices,release-archives,release-programs + env: + EVENT: ${{ github.event_name }} + BASE_REF: ${{ github.base_ref }} + run: | + if [ "$EVENT" = pull_request ]; then + scripts/dev/check.sh --all --changed "origin/$BASE_REF" --skip release-toolchain,third-party-notices,release-archives,release-programs + else + scripts/dev/check.sh --all --skip release-toolchain,third-party-notices,release-archives,release-programs + fi # What a repository release carries (docs/releasing.md), checked on every # commit so a tag is never the first to find a gap. The toolchain is the exact diff --git a/AGENTS.md b/AGENTS.md index 26addc8..467b71e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -70,6 +70,17 @@ summary block, and anything you stopped on or chose not to do. from pinned Runtime, Gateway and old-Runner commits (it needs network access to fetch them). A pin and the release name beside it are moved together. The two test steps fail if a named test does not run and pass, so a skip is a failure there. +- A pull request's `Runner` jobs run `scripts/dev/check.sh --all --changed origin/` (less + the four release steps): only the steps `jpdev.json` maps the changed paths to, and the whole + list when a changed path matches no rule (the workflows, `.gitattributes`, `.gitignore`, a file + in a new place) or when `jpdev.json`, `dev.json` or the runner changed. A push to `main` runs the + whole list, and only that run is what a release is held to; `Release contents` always runs its + four steps. Run the same selection locally with `scripts/dev/check.sh --changed origin/main` (or + `jpdev check --changed`). The test steps need `build-pinned` first, so every rule that selects + `manual-gate`, `unit-tests` or `chain-tests` selects `build-pinned` too. The Go tests read + `openapi.json`, `vectors/`, `docs/MAPPING-V2.md`, `docs/design/*.json` and test data across + packages, so those paths select the test steps. A new step, a new input of a step or a test that + reads a new file is mapped in `jpdev.json`; when unsure, map it broader. - Runner is a single-owner local Jobs pilot; do not add shared-user permissions, external actions or agent loops. Do not put real credentials, customer evidence or private operational records in examples or fixtures. diff --git a/CLAUDE.md b/CLAUDE.md index 26addc8..467b71e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -70,6 +70,17 @@ summary block, and anything you stopped on or chose not to do. from pinned Runtime, Gateway and old-Runner commits (it needs network access to fetch them). A pin and the release name beside it are moved together. The two test steps fail if a named test does not run and pass, so a skip is a failure there. +- A pull request's `Runner` jobs run `scripts/dev/check.sh --all --changed origin/` (less + the four release steps): only the steps `jpdev.json` maps the changed paths to, and the whole + list when a changed path matches no rule (the workflows, `.gitattributes`, `.gitignore`, a file + in a new place) or when `jpdev.json`, `dev.json` or the runner changed. A push to `main` runs the + whole list, and only that run is what a release is held to; `Release contents` always runs its + four steps. Run the same selection locally with `scripts/dev/check.sh --changed origin/main` (or + `jpdev check --changed`). The test steps need `build-pinned` first, so every rule that selects + `manual-gate`, `unit-tests` or `chain-tests` selects `build-pinned` too. The Go tests read + `openapi.json`, `vectors/`, `docs/MAPPING-V2.md`, `docs/design/*.json` and test data across + packages, so those paths select the test steps. A new step, a new input of a step or a test that + reads a new file is mapped in `jpdev.json`; when unsure, map it broader. - Runner is a single-owner local Jobs pilot; do not add shared-user permissions, external actions or agent loops. Do not put real credentials, customer evidence or private operational records in examples or fixtures. diff --git a/jpdev.json b/jpdev.json new file mode 100644 index 0000000..d472e5f --- /dev/null +++ b/jpdev.json @@ -0,0 +1,53 @@ +{ + "version": 1, + "changed": [ + { + "paths": ["**/*.go", "go.mod", "go.sum"], + "checks": ["local-paths", "agent-docs", "diff-check", "go-fmt", "go-vet", "build-pinned", "manual-gate", "unit-tests", "chain-tests", "build", "third-party-notices"] + }, + { + "paths": ["go.mod", "go.sum"], + "checks": ["local-paths", "agent-docs", "diff-check", "release-toolchain", "release-archives"] + }, + { + "paths": ["cmd/**", "internal/**", "tools/preparation-vectors/**"], + "checks": ["local-paths", "agent-docs", "diff-check", "go-vet", "build-pinned", "manual-gate", "unit-tests", "chain-tests", "build"] + }, + { + "paths": ["cmd/**"], + "checks": ["local-paths", "agent-docs", "diff-check", "release-programs"] + }, + { + "paths": ["vectors/**", "docs/MAPPING-V2.md", "docs/design/*.json"], + "checks": ["local-paths", "agent-docs", "diff-check", "build-pinned", "manual-gate", "unit-tests", "chain-tests"] + }, + { + "paths": ["openapi.json"], + "checks": ["local-paths", "agent-docs", "diff-check", "openapi", "build-pinned", "manual-gate", "unit-tests", "chain-tests"] + }, + { + "paths": ["scripts/checks/build-pinned.sh", "scripts/checks/manual-gate.sh", "scripts/checks/unit-tests.sh", "scripts/checks/chain-tests.sh"], + "checks": ["local-paths", "agent-docs", "diff-check", "build-pinned", "manual-gate", "unit-tests", "chain-tests"] + }, + { + "paths": ["THIRD_PARTY_NOTICES", "tools/third_party_notices.py"], + "checks": ["local-paths", "agent-docs", "diff-check", "third-party-notices"] + }, + { + "paths": ["tools/release_archives.py", "tools/test_release_archives.py"], + "checks": ["local-paths", "agent-docs", "diff-check", "release-archives"] + }, + { + "paths": [".goreleaser.yml", "scripts/checks/release-programs.sh"], + "checks": ["local-paths", "agent-docs", "diff-check", "release-programs"] + }, + { + "paths": ["scripts/checks/release-toolchain.sh"], + "checks": ["local-paths", "agent-docs", "diff-check", "release-toolchain"] + }, + { + "paths": ["*.md", "docs/**", "LICENSE", "deploy/**", "scripts/checks/local-paths.sh", "scripts/sync-agent-docs.sh", "scripts/dev/handover_check.sh"], + "checks": ["local-paths", "agent-docs", "diff-check"] + } + ] +}