fix(ci+testing): fail-closed nojobs fallback in dedup gate; TLS-aware redis defaults mock

- the dedup gate no longer infers coverage from overall run conclusion when
  no 'Test and Build /' jobs match — a renamed or skipped test job now runs
  the tests instead of skipping them
- the shared getRedisConnectionDefaults mock mirrors the real TLS resolution
  (rediss:// to a raw IP requires REDIS_TLS_SERVERNAME and yields
  tls.servername)

Author: waleedlatif1

.github/workflows/ci.yml

@@ -116,14 +116,12 @@ jobs:
                 elif any($t[]; .conclusion != null and .conclusion != "success") then "failed"
                 else "pending" end' 2>/dev/null || echo pending)"
               if [ "$STATE" = "nojobs" ]; then
-                RUN_STATE="$(printf '%s' "$RUN_JSON" | jq -r '.workflow_runs[0] | if .status == "completed" then .conclusion else "pending" end' 2>/dev/null || echo pending)"
-                if [ "$RUN_STATE" = "success" ]; then
-                  STATE="success"
-                elif [ "$RUN_STATE" != "pending" ]; then
-                  STATE="failed"
-                else
-                  STATE="pending"
-                fi
+                # Fail closed: no jobs matching the "Test and Build /" prefix
+                # means the reusable-workflow job name changed (or tests were
+                # skipped) — never infer coverage from the overall run
+                # conclusion. Update the prefix here if test-build is renamed.
+                echo "Push run ${RUN_ID} has no 'Test and Build /' jobs — running tests in this PR run (update the prefix if the job was renamed)."
+                break
               fi
               if [ "$STATE" = "success" ]; then
                 # (3) Re-verify merge-tree equivalence against the LIVE base

packages/testing/src/mocks/redis-config.mock.ts

@@ -1,14 +1,45 @@
 import { vi } from 'vitest'
+import { envMockFns } from './env.mock'
 
-function getRedisConnectionDefaultsImpl(_url?: string): {
+/**
+ * Mirrors the real `resolveRedisTlsOptions`: `rediss://` URLs targeting a raw
+ * IPv4 host require `REDIS_TLS_SERVERNAME` (cert hostname verification cannot
+ * match an IP) and yield a `tls.servername`; DNS hosts and plain `redis://`
+ * URLs add no TLS options.
+ */
+function resolveTlsOptionsImpl(url: string | undefined): { servername: string } | undefined {
+  if (!url) return undefined
+  let parsed: URL
+  try {
+    parsed = new URL(url)
+  } catch {
+    return undefined
+  }
+  if (parsed.protocol !== 'rediss:') return undefined
+  if (!/^\d{1,3}(\.\d{1,3}){3}$/.test(parsed.hostname)) return undefined
+  const servername = envMockFns.getEnv('REDIS_TLS_SERVERNAME')
+  if (!servername) {
+    throw new Error(
+      'REDIS_TLS_SERVERNAME must be set when REDIS_URL targets an IP over rediss://. ' +
+        'TLS cert hostname verification cannot match an IP — set REDIS_TLS_SERVERNAME ' +
+        'to the DNS name the cert was issued for (the ElastiCache primary endpoint).'
+    )
+  }
+  return { servername }
+}
+
+function getRedisConnectionDefaultsImpl(url?: string): {
   keepAlive: number
   connectTimeout: number
   enableOfflineQueue: boolean
+  tls?: { servername: string }
 } {
+  const tls = resolveTlsOptionsImpl(url)
   return {
     keepAlive: 1000,
     connectTimeout: 10000,
     enableOfflineQueue: true,
+    ...(tls ? { tls } : {}),
   }
 }