refactor(ci): unify the two runtime parity matrices into one event-parameterized job

aledbf · claude · aledbf · commit a99f1d39b73e · 2026-07-13T23:23:13.000-03:00
The push/PR scoped lane and the daily full lane were two near-identical sharded
matrix jobs (plus two separate gate jobs and a separate coverage-report), differing
only in scope, binary, and trigger. Collapse them into one `parity-runtime` matrix
(4 shards) parameterized by event:

  push/PR — scoped to the affected commands, plain binary: a fast gate.
  daily   — the full matrix with the instrumented binary, so one run gates parity
            AND measures coverage; still gated by daily-changes on quiet days.

A single `parity-runtime-gate` absorbs the old push/PR aggregator, the daily report,
and the per-PR coverage-report: it gates the matrix (and, on daily, publish) and
merges every lane's covdata into the one cross-lane number, on all events. Runtime
parity goes from 7 jobs to 4 (daily-changes, parity-runtime, parity-publish-full,
parity-runtime-gate). main is not branch-protected, so the check renames are safe.

The sharding/reuse/gating regression tests are updated for the unified job names.

Co-Authored-By: Claude Opus 4.8 &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/go-cli.yml b/.github/workflows/go-cli.yml
@@ -133,94 +133,10 @@ jobs:
           path: artifacts/coverage/data/contract
           if-no-files-found: error
 
-  # Runtime lane of the parity matrix (creates real containers via Docker) on
-  # push/PR, SCOPED to the commands affected by the change: the full matrix takes
-  # ~45 min, so the devtool parity-affected mapping reduces the diff to a
-  # PARITY_COMMAND allowlist (or "all"/"none"). The daily parity-runtime-full job
-  # is the backstop that always runs the whole thing.
-  parity-runtime-shard:
-    if: github.event_name == 'push' || github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    needs: lint-and-test
-    strategy:
-      # Split the affected runtime cases across independent runners (each with its
-      # own docker daemon). fail-fast off so one shard's failure still reports the
-      # others. The harness selects this shard's slice via PARITY_SHARD_INDEX.
-      fail-fast: false
-      matrix:
-        shard: [0, 1]
-    env:
-      PARITY_RUNTIME_TIMEOUT: "10m"
-      # Two shards, each running two cases at a time: the per-case isolation
-      # (unique id-labels / COMPOSE_PROJECT_NAME / BUILDX_BUILDER) makes -parallel 2
-      # safe on a 2-core runner now that each runner only owns half the cases.
-      PARITY_PARALLEL: "2"
-      PARITY_SHARD_INDEX: ${{ matrix.shard }}
-      PARITY_SHARD_TOTAL: "2"
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          submodules: recursive
-          # Full history so the diff base (PR base / previous push) is present.
-          fetch-depth: 0
-      # devtool (the affected-commands mapping) runs before the composite setup,
-      # so it needs the Go toolchain here.
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-      - name: Determine affected parity commands
-        id: affected
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            base="${{ github.event.pull_request.base.sha }}"; head="${{ github.event.pull_request.head.sha }}"
-          else
-            base="${{ github.event.before }}"; head="${{ github.sha }}"
-          fi
-          go run ./cmd/devtool parity-affected-commands "$base" "$head" >> "$GITHUB_OUTPUT"
-      # Toolchain + runner prep + reference oracle, shared with parity-runtime-full.
-      - if: steps.affected.outputs.run == 'true'
-        uses: ./.github/actions/setup-parity-runtime
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-      - if: steps.affected.outputs.run == 'true'
-        env:
-          PARITY_COMMAND: ${{ steps.affected.outputs.commands }}
-        run: task parity:runtime
-      - if: always() && steps.affected.outputs.run == 'true'
-        run: |
-          mkdir -p artifacts
-          git -C reference rev-parse HEAD > artifacts/reference-commit.txt
-      - uses: actions/upload-artifact@v7
-        if: always() && steps.affected.outputs.run == 'true'
-        with:
-          name: parity-runtime-v0.88.0-shard-${{ matrix.shard }}
-          path: artifacts/
-          if-no-files-found: error
-      - if: always() && steps.affected.outputs.run == 'true'
-        run: task clean
-
-  # Stable required-check name aggregating the sharded runtime lane, so sharding
-  # does not change the check name branch protection depends on.
-  parity-runtime:
-    if: always() && (github.event_name == 'push' || github.event_name == 'pull_request')
-    runs-on: ubuntu-latest
-    needs: parity-runtime-shard
-    steps:
-      - name: Gate on all runtime shards
-        run: |
-          result="${{ needs.parity-runtime-shard.result }}"
-          echo "parity-runtime-shard aggregate result: $result"
-          case "$result" in
-            success|skipped) exit 0 ;;
-            *) echo "one or more runtime shards failed"; exit 1 ;;
-          esac
-
-  # Gate the expensive daily lanes on "did the repo change today?". A manual dispatch
-  # always runs; a scheduled run only proceeds if HEAD has a commit within the last
-  # day (devtool daily-changed). On a private/billed repo this skips the full
-  # runtime matrix + publish on quiet days. Runs on schedule/dispatch so it is never
-  # skipped for those events — the heavy jobs `needs:` it, and a skipped need would
-  # skip them regardless of its output.
+  # "Did the repo change today?" gate for the expensive daily lanes. Manual dispatch
+  # always runs; a scheduled run only proceeds when HEAD has a commit within the last
+  # day (devtool daily-changed) — on a private/billed repo this skips the daily matrix
+  # on quiet days. Runs on schedule/dispatch so the daily lanes' `needs:` is satisfied.
   daily-changes:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
@@ -240,66 +156,101 @@ jobs:
             go run ./cmd/devtool daily-changed >> "$GITHUB_OUTPUT"
           fi
 
-  # Full runtime parity matrix. Runs once a day (schedule, only when the repo changed
-  # — see daily-changes) and on manual dispatch — the exhaustive backstop for the
-  # scoped push/PR job above. Sharded across independent runners (same
-  # PARITY_SHARD_INDEX/TOTAL harness as the push/PR lane) so the 175-case matrix no
-  # longer contends for one runner's CPU/disk/daemon, which was starving the
-  # container setups and failing downstream exec cases. PARITY_SHARD_TOTAL MUST equal
-  # the length of matrix.shard — parity_sharding_workflow_test.go enforces that, so a
-  # mismatch can't silently drop cases.
-  parity-runtime-full:
+  # Single sharded runtime parity matrix, parameterized by event:
+  #   push/PR — SCOPED to the commands the diff can affect (devtool parity-affected),
+  #             run with the plain binary: a fast gate (the full matrix is ~45 min).
+  #   daily   — the FULL matrix with the instrumented binary, so one run gates parity
+  #             AND measures coverage; daily-changes keeps it off on quiet days.
+  # 4 shards across independent runners (each its own docker daemon) so the matrix
+  # never contends for one runner's CPU/disk/daemon. PARITY_SHARD_TOTAL MUST equal the
+  # length of matrix.shard — parity_sharding_workflow_test.go enforces it so a mismatch
+  # can't silently drop cases.
+  parity-runtime:
     needs: [lint-and-test, daily-changes]
-    if: needs.daily-changes.outputs.run == 'true'
+    # Every push/PR, and on schedule/dispatch only when the repo changed. always() so a
+    # skipped daily-changes (push/PR) doesn't skip this job; the explicit lint-and-test
+    # check restores the normal "needs succeeded" gate.
+    if: >-
+      always()
+      && needs.lint-and-test.result == 'success'
+      && (github.event_name == 'push' || github.event_name == 'pull_request'
+          || needs.daily-changes.outputs.run == 'true')
     runs-on: ubuntu-latest
     strategy:
-      # fail-fast off so one shard's failure still reports the others.
       fail-fast: false
       matrix:
         shard: [0, 1, 2, 3]
     env:
       PARITY_RUNTIME_TIMEOUT: "10m"
-      # Each shard owns ~a quarter of the matrix, so -parallel 2 per runner matches
-      # the push/PR shard lane's proven-safe load instead of the old single-runner 3.
+      # Each shard owns ~a quarter of the selected cases; -parallel 2 per 2-core runner
+      # is the proven-safe load (per-case id-label / COMPOSE_PROJECT_NAME isolation).
       PARITY_PARALLEL: "2"
       PARITY_SHARD_INDEX: ${{ matrix.shard }}
       PARITY_SHARD_TOTAL: "4"
     steps:
       - uses: actions/checkout@v7
         with:
           submodules: recursive
-      - uses: ./.github/actions/setup-parity-runtime
+          # Full history so the push/PR diff base is present for the affected mapping.
+          fetch-depth: 0
+      # devtool (the affected mapping) runs before the composite setup, so Go here.
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Plan this run
+        id: plan
+        run: |
+          if [ "${{ github.event_name }}" = "push" ] || [ "${{ github.event_name }}" = "pull_request" ]; then
+            if [ "${{ github.event_name }}" = "pull_request" ]; then
+              base="${{ github.event.pull_request.base.sha }}"; head="${{ github.event.pull_request.head.sha }}"
+            else
+              base="${{ github.event.before }}"; head="${{ github.sha }}"
+            fi
+            go run ./cmd/devtool parity-affected-commands "$base" "$head" >> "$GITHUB_OUTPUT"
+          else
+            # daily: the full matrix (this job only runs when daily-changes said so).
+            echo "run=true" >> "$GITHUB_OUTPUT"
+            echo "commands=all" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.plan.outputs.run == 'true'
+        uses: ./.github/actions/setup-parity-runtime
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-      # Instrumented binary: measures coverage AND gates parity on this shard's slice.
-      - run: task coverage:parity-runtime
+      # push/PR: scoped, plain binary — a fast gate.
+      - name: Run parity (scoped, plain)
+        if: steps.plan.outputs.run == 'true' && (github.event_name == 'push' || github.event_name == 'pull_request')
+        env:
+          PARITY_COMMAND: ${{ steps.plan.outputs.commands }}
+        run: task parity:runtime
+      # daily: full matrix, instrumented binary — gates parity AND measures coverage.
+      - name: Run parity (full, instrumented)
+        if: steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+        run: task coverage:parity-runtime
       - name: Coverage summary
-        if: always()
+        if: always() && steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
         run: go run ./cmd/devtool coverage-report artifacts/coverage/data/runtime "parity:runtime shard ${{ matrix.shard }}" >> "$GITHUB_STEP_SUMMARY"
-      - if: always()
+      - if: always() && steps.plan.outputs.run == 'true'
         run: |
           mkdir -p artifacts
           git -C reference rev-parse HEAD > artifacts/reference-commit.txt
       - uses: actions/upload-artifact@v7
-        if: always()
+        if: always() && steps.plan.outputs.run == 'true'
         with:
-          name: parity-runtime-full-v0.88.0-shard-${{ matrix.shard }}
+          name: parity-runtime-v0.88.0-shard-${{ matrix.shard }}
           path: artifacts/
           if-no-files-found: error
-      # covdata slice for the cross-lane merge (distinct name per shard so the merge
-      # job unions them instead of clobbering).
+      # daily only: covdata slice for the cross-lane merge (distinct name per shard).
       - uses: actions/upload-artifact@v7
-        if: always()
+        if: always() && steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
         with:
           name: covdata-runtime-shard-${{ matrix.shard }}
           path: artifacts/coverage/data/runtime
           if-no-files-found: error
-      - if: always()
+      - if: always() && steps.plan.outputs.run == 'true'
         run: task clean
 
-  # Publish parity (features/templates → ephemeral OCI registry). Independent of the
-  # runtime matrix, so it runs as its own job rather than stealing a runtime shard's
-  # runner. Was folded into the old monolithic parity-runtime-full.
+  # Publish parity (features/templates → ephemeral OCI registry). Daily only, its own
+  # job so it doesn't steal a runtime shard's runner.
   parity-publish-full:
     needs: [lint-and-test, daily-changes]
     if: needs.daily-changes.outputs.run == 'true'
@@ -324,14 +275,15 @@ jobs:
       - if: always()
         run: task clean
 
-  # Daily gate + cross-lane coverage. Aggregates the sharded runtime lane and the
-  # publish lane into one pass/fail (mirrors the push/PR parity-runtime gate) and
-  # merges every lane's covdata — unit + e2e + contract (which also run on schedule)
-  # plus the runtime shards + publish — into the one true cross-lane number.
-  parity-runtime-full-report:
-    if: always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
+  # Single gate + cross-lane coverage for ALL events (absorbs the old push/PR
+  # parity-runtime aggregator, the daily report, and the per-PR coverage-report):
+  # gates the runtime matrix (and, on daily, publish) into one pass/fail, and merges
+  # every lane's covdata (unit + e2e + contract, plus the daily runtime shards +
+  # publish) into the one true cross-lane number.
+  parity-runtime-gate:
+    if: always()
     runs-on: ubuntu-latest
-    needs: [lint-and-test, e2e, parity, parity-runtime-full, parity-publish-full]
+    needs: [lint-and-test, e2e, parity, parity-runtime, parity-publish-full]
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
@@ -357,56 +309,23 @@ jobs:
         run: task coverage:merge | tee -a "$GITHUB_STEP_SUMMARY"
       - uses: actions/upload-artifact@v7
         with:
-          name: covdata-merged-full
+          name: covdata-merged
           path: artifacts/coverage/data/merged.out
           if-no-files-found: warn
-      # Final verdict last, so the coverage report is posted even when a shard failed.
-      - name: Gate on all runtime shards + publish
+      # Final verdict last, so coverage is posted even when a shard failed. A skipped
+      # lane (publish on push/PR, or the whole matrix on a quiet daily) counts as pass.
+      - name: Gate on runtime + publish
         run: |
-          runtime="${{ needs.parity-runtime-full.result }}"
+          runtime="${{ needs.parity-runtime.result }}"
           publish="${{ needs.parity-publish-full.result }}"
-          echo "runtime shards: $runtime, publish: $publish"
+          echo "runtime: $runtime, publish: $publish"
           for r in "$runtime" "$publish"; do
             case "$r" in
               success|skipped) ;;
               *) echo "runtime/publish parity failed"; exit 1 ;;
             esac
           done
 
-  # Cross-lane coverage: merge the per-PR lanes' covdata (unit + e2e + contract)
-  # into the one number no single lane shows, and post it to the run summary.
-  coverage-report:
-    if: always() && (github.event_name == 'push' || github.event_name == 'pull_request')
-    runs-on: ubuntu-latest
-    needs: [lint-and-test, e2e, parity]
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-      - uses: go-task/setup-task@v2
-        with:
-          version: 3.x
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Download lane covdata
-        uses: actions/download-artifact@v8
-        with:
-          pattern: covdata-*
-          path: artifacts/coverage/data
-      # download-artifact nests each artifact under covdata-<lane>/; flatten to <lane>/.
-      - name: Normalize lane dirs
-        run: |
-          cd artifacts/coverage/data
-          for d in covdata-*; do [ -d "$d" ] && mv "$d" "${d#covdata-}"; done
-          ls -R . || true
-      - name: Merged coverage report
-        run: task coverage:merge | tee -a "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@v7
-        with:
-          name: covdata-merged
-          path: artifacts/coverage/data/merged.out
-          if-no-files-found: warn
-
   cross-compile:
     runs-on: ubuntu-latest
     needs: lint-and-test
diff --git a/internal/cli/parity_sharding_workflow_test.go b/internal/cli/parity_sharding_workflow_test.go
@@ -109,25 +109,24 @@ func TestWorkflowShardMatrixMatchesShardTotal(t *testing.T) {
 		}
 	}
 
-	// Both the push/PR (parity-runtime-shard) and the daily (parity-runtime-full)
-	// lanes are sharded; if neither is found the parsing (or the jobs) regressed.
-	if sharded < 2 {
-		t.Errorf("found %d sharded parity jobs, want at least 2 (push/PR + daily full)", sharded)
+	// The unified runtime lane (parity-runtime) is sharded; if it isn't found the
+	// parsing (or the job) regressed.
+	if sharded < 1 {
+		t.Errorf("found %d sharded parity jobs, want at least 1 (parity-runtime)", sharded)
 	}
 }
 
-// TestWorkflowRuntimeJobsShareCompositeAction locks in the reuse between the two
-// runtime lanes: both must set up their runner through the shared composite action
-// (toolchain + ci:prepare-runner + reference) so the push/PR and daily environments
-// can't drift apart. (A lane may also add a bare setup-go before the composite —
-// parity-runtime-shard needs the Go toolchain for the devtool affected-commands
-// step that decides whether the composite even runs — but node/task setup belongs
-// only in the shared action, never re-inlined.)
+// TestWorkflowRuntimeJobsShareCompositeAction locks in the reuse for the runtime
+// lanes: they must set up their runner through the shared composite action
+// (toolchain + ci:prepare-runner + reference) so the environments can't drift apart.
+// (A lane may also add a bare setup-go before the composite — parity-runtime needs
+// the Go toolchain for the devtool plan step that decides whether the composite even
+// runs — but node/task setup belongs only in the shared action, never re-inlined.)
 func TestWorkflowRuntimeJobsShareCompositeAction(t *testing.T) {
 	wf := loadWorkflow(t)
 	const action = "./.github/actions/setup-parity-runtime"
 
-	for _, name := range []string{"parity-runtime-shard", "parity-runtime-full"} {
+	for _, name := range []string{"parity-runtime", "parity-publish-full"} {
 		job, ok := wf.Jobs[name]
 		if !ok {
 			t.Errorf("job %q missing", name)
@@ -152,14 +151,15 @@ func TestWorkflowRuntimeJobsShareCompositeAction(t *testing.T) {
 // TestWorkflowDailyLanesGatedOnChanges asserts the expensive daily lanes only run
 // when the repo changed that day: each must `needs: daily-changes` and gate on its
 // output. Dropping either turns the change-detection into a no-op and the matrix
-// runs (and bills) every day regardless.
+// runs (and bills) every day regardless. (parity-runtime also runs on push/PR; its
+// `if` gates the daily path on the same output.)
 func TestWorkflowDailyLanesGatedOnChanges(t *testing.T) {
 	wf := loadWorkflow(t)
 
 	if _, ok := wf.Jobs["daily-changes"]; !ok {
 		t.Fatal("daily-changes job missing — nothing gates the daily lanes")
 	}
-	for _, name := range []string{"parity-runtime-full", "parity-publish-full"} {
+	for _, name := range []string{"parity-runtime", "parity-publish-full"} {
 		job, ok := wf.Jobs[name]
 		if !ok {
 			t.Errorf("job %q missing", name)
