ci: split Windows server tools advisory shard

[Astro-Han]

Summary

Split the Windows advisory opencode-server-tools shard into smaller server-derived shards and add process-level attempt timeouts for the shards that previously could hang until the job timeout cancelled the run.

Why

The latest dev push for #1387 cancelled windows-advisory run 27802484637 because unit-windows-opencode-server-tools job 82275434554 reached its job timeout while bun test was still running. The log showed no assertion failure: setup succeeded, other Windows shards passed, and the unit process stopped producing output after test/browser/session.test.ts before GitHub cancelled the operation.

This PR keeps the Windows advisory coverage but prevents one broad shard or one hung Bun process from consuming the entire job budget before the retry wrapper can observe an exit code. It unblocks #1387 post-merge closeout and future #936 migration closeout.

Related Issue

Related to #936.

Human Review Status

Pending

Review Focus

Please check that the new shard boundaries preserve all existing opencode Windows advisory test coverage exactly once, and that the per-attempt timeout budget is large enough for normal runs while still firing before the job-level timeout.

Risk Notes

Windows-only runtime behavior cannot be fully proven on this macOS worktree; the PR CI Windows advisory jobs are the authoritative verification. No UI, copy, docs, dependency, credential, deletion, release, or generated-content surface changed.

How To Verify

Read failing GitHub Actions evidence: run 27802484637 / job 82275434554 showed setup succeeded, other Windows shards passed, and the unit step was cancelled by job timeout with no test assertion failure.
RED: bun test test/github/ci-workflow.test.ts failed before the workflow update because the expected split shards and attempt timeout contract were missing.
Focused workflow contract: bun test test/github/ci-workflow.test.ts passed, 18 passed.
Workflow tests: bun test test/github passed, 48 passed.
Typecheck: bun run typecheck passed in packages/opencode.
Actionlint: actionlint -color -shellcheck= .github/workflows/windows-advisory.yml passed.
Diff whitespace: git diff --check passed.
Local shard smoke: server-tools, browser-agent, and server-support shard commands passed locally with JUnit reporter output after the workflow artifact directory was prepared.
Limitation: local macOS environment does not provide GNU timeout, so the timeout wrapper itself is left to GitHub Actions Windows CI.

Screenshots or Recordings

Not applicable. No visible UI changes.

Checklist

How to use this checklist:

• Tick a box by replacing [ ] with [x]. Do not edit, add, or remove items.
• The bot-applied label items can only be honestly ticked AFTER the PR is opened and the labeler / priority-triage bots have run — return to the PR description and tick them then.
• Most items are required. The few that are conditional are explicitly marked (conditional); for those, leave unticked if they truly do not apply and explain why in Risk Notes. All other items must be ticked before requesting human review.

• Type label — this PR carries exactly one of bug, enhancement, task, documentation. Type labels are author-added; the labeler bot does NOT assign them. Add the label in the GitHub UI, then tick this.
• Routing labels — this PR carries at least one of app, ui, platform, harness, ci. The labeler bot assigns these on PR open based on changed paths. Confirm the bot's choice (or override if wrong), then tick this.
• Priority label — this PR carries exactly one of P0, P1, P2, P3. The priority-triage bot suggests one on PR open. Confirm or override, then tick this.
• Human Review Status above is set to Pending, Approved by @<reviewer>, or Not required: <reason> (default is Pending; "not required" is restricted to bot-authored low-risk PRs).
• I linked the related issue, or stated in Summary why there is no issue.
• I described the review focus and any meaningful risks.
• I replaced the example block in How To Verify with the real verification steps and the key result for each.
• I did not introduce unrelated refactors, dependencies, generated files, or file changes beyond the stated scope.
• (conditional) I manually checked visible UI or copy changes when needed, with screenshots or recordings. Leave unticked only if no visible UI or copy changed.
• (conditional) I considered macOS and Windows impact for platform, packaging, updater, signing, paths, shell, or permissions changes. Leave unticked only if no platform/packaging surface was touched.
• (conditional) I called out docs, release notes, dependencies, permissions, credentials, deletion behavior, generated content, or local file changes when relevant. Leave unticked only if none of those surfaces was touched.
• I reviewed the final diff for unrelated changes and suspicious dependency changes.
• I am targeting dev, and my PR title and commit messages use Conventional Commits in English.

Summary by CodeRabbit

• Chores

  • Optimized CI/CD workflow test execution by rebalancing parallel test shards and introducing per-attempt timeout handling to improve reliability and execution efficiency.

• Tests

  • Updated test expectations to reflect changes in workflow shard organization and timeout behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8a6d6446-8795-4d93-aa55-6b6e42aee051

📥 Commits

Reviewing files that changed from the base of the PR and between 198f9b3 and 51ed54d.

📒 Files selected for processing (2)

• .github/workflows/windows-advisory.yml
• packages/opencode/test/github/ci-workflow.test.ts

---

📝 Walkthrough

Walkthrough

The Windows advisory workflow splits the opencode test matrix into seven shards by extracting opencode-browser-agent and opencode-server-support from opencode-server-tools. Each new shard gets attempt_timeout_minutes; the retry loop is extended to wrap attempts with timeout ...m and detect exit code 124. CI workflow tests are updated to match.

Changes

Windows opencode shard split and per-attempt timeout

Layer / File(s)	Summary
New opencode shard matrix entries .github/workflows/windows-advisory.yml	Updates the matrix comment to seven children, narrows opencode-server-tools to test/server, and adds opencode-browser-agent and opencode-server-support entries with timeout_minutes, attempt_timeout_minutes, focused bun test paths, and dedicated JUnit report files.
Per-attempt timeout in the retry loop .github/workflows/windows-advisory.yml	Reads attempt_timeout_minutes from the matrix, validates the timeout binary is available when set, wraps each retry attempt in timeout ...m bash -lc, and treats exit code 124 as a timed-out attempt for logging while preserving existing retry/failure propagation.
Test assertions for shards, matrix shape, and timeout invariants packages/opencode/test/github/ci-workflow.test.ts	Updates shard definitions with attemptTimeoutMinutes, asserts timeout-wrapped retry behavior with the "Windows unit attempt timed out" marker, updates matrix include construction to conditionally emit attempt_timeout_minutes, adds opencode-server-support to the coverage order, and adds a new test verifying timeout_minutes ≥ 2 * attempt_timeout_minutes + 10 for all server-derived shards.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Astro-Han/pawwork#146: Directly modifies the same Windows opencode shard definitions and ci-workflow.test.ts expectations around strategy.matrix.include entries including opencode-server-tools.
• Astro-Han/pawwork#409: Introduced the windows-advisory workflow structure and the initial ci-workflow.test.ts validations that this PR builds on.

Suggested labels

ci, windows, github_actions, harness, enhancement

Poem

🐇 Hop hop, the shards now split in three,
Seven children run in parallel, free!
Each attempt gets a timeout to mind,
Exit one-two-four? No worries, rewind.
The rabbit checks the clock with care—
Fast CI hops beyond compare! 🕐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: splitting the Windows advisory opencode-server-tools shard into smaller shards with attempt timeouts.
Description check	✅ Passed	The description is comprehensive and complete, covering all required template sections including Summary, Why, Related Issue, Human Review Status, Review Focus, Risk Notes, How To Verify, and a fully completed checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/ci-windows-server-tools-split2

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Suggested priority: P3 (only low-risk paths changed (.github/workflows/windows-advisory.yml, packages/opencode/test/github/ci-workflow.test.ts)).

P1/P0 are reserved for maintainer confirmation. Please relabel manually if this is a release blocker, security issue, data-loss risk, or updater/runtime failure.