chore: follow-ups to #923

[ndizazzo]

#923 merged before fixes landed

Summary by CodeRabbit

• Bug Fixes
  • Improved CI job routing for Linux test and CUDA workflows by updating runner selection and skipping empty Linux test runs.
  • Tightened checkout and job permissions across CI for safer execution.
  • Updated test coverage checks so additional workspace crates are included in CI validation.
  • Made Linux CPU builds more resilient when sccache is unavailable.

[coderabbitai]

Warning

Review limit reached

@ndizazzo, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 16 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: aef1a3af-16cd-4b0d-9b68-f6a49e72e631

📥 Commits

Reviewing files that changed from the base of the PR and between 9d47784 and 34d5e6d.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

📝 Walkthrough

Walkthrough

Replaces the carrack self-hosted runner label with amd64/gpu-nvidia across all workflows and actionlint config. Adds a linux_test_groups_json computed output to the compute-changes action and migrates the CI Linux test matrix to consume it dynamically. Adds an sccache availability guard in the Linux CPU job, expands sdk-api and xtask crate coverage for new mesh-llm-* crates, and applies contents: read permissions plus persist-credentials: false to all workflow jobs.

Changes

CI/CD pipeline changes

Layer / File(s)	Summary
Runner label migration (carrack → amd64/gpu-nvidia) .github/actionlint.yaml, .github/workflows/pr_builds.yml, .github/workflows/release.yml, .github/workflows/ci.yml	Removes the carrack runner label and substitutes amd64 + gpu-nvidia in actionlint allowed labels, the CUDA slim PR build matrix entry, the two release CUDA jobs, and the CI CUDA slim job.
Compute Linux test groups action output .github/actions/compute-changes/action.yml, .github/workflows/ci.yml	Adds the linux_test_groups_json composite-action output, populates it via a bash helper that appends {group, cache_key} objects based on event type and affected crates, exports it to GITHUB_OUTPUT, and wires it into the CI changes job outputs.
Dynamic Linux test matrix in CI .github/workflows/ci.yml	Gates the Linux tests job on linux_test_groups_json != '[]' and replaces the static matrix include list with fromJson(needs.changes.outputs.linux_test_groups_json).
sccache availability guard in Linux CPU job .github/workflows/ci.yml	Inserts a pre-cache step that detects missing sccache and clears RUSTC_WRAPPER/related flags; the stats step also exits early when sccache is absent.
sdk-api crate expansion and xtask coverage .github/workflows/ci.yml, tools/xtask/src/main.rs	Expands the sdk-api step condition to fire on mesh-llm-native-runtime, mesh-llm-routing, and mesh-llm-types; adds the same crates to REQUIRED_TEST_CRATES and the xtask cargo test loop.
Permissions and credential hardening .github/workflows/ci.yml	Adds permissions: contents: read at workflow level and to all individual jobs; sets persist-credentials: false on checkout steps across every job (changes, Linux CPU, Linux tests, smoke, macOS, CUDA, ROCm, Vulkan, Windows).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Mesh-LLM/mesh-llm#923: Modifies the same workflows (ci.yml, pr_builds.yml, release.yml, actionlint.yaml) to route CUDA jobs to self-hosted runners using overlapping label sets.

Suggested reviewers

• michaelneale
• i386

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is related to the PR but too generic to convey the main change.	Use a specific title like “Update CI runner labels and Linux test routing” to reflect the actual follow-up changes.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/parallel-main-builds

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/ci.yml (1)

325-338: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

This gate still skips valid Linux test groups.

Line 325 still requires linux_inference_artifact_required == 'true' and a successful linux_cpu_artifact, but .github/actions/compute-changes/action.yml now emits sdk-api groups for crates like mesh-llm-sdk, mesh-llm-cli, mesh-llm-tui, mesh-llm-embedded-runtime, and mesh-llm-nodejs without setting inference_artifact_required. Those PRs produce a non-empty linux_test_groups_json, yet this job never starts. Please align this gate with the matrix producer, or widen the artifact predicate so the new groups can actually run.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 325 - 338, The Linux tests workflow
gate is too restrictive and blocks valid matrix entries emitted by the changes
computation. Update the job condition on the Linux tests matrix so it matches
the groups produced by `compute-changes` in
`.github/actions/compute-changes/action.yml`, especially the new `sdk-api`
groups from `mesh-llm-sdk`, `mesh-llm-cli`, `mesh-llm-tui`,
`mesh-llm-embedded-runtime`, and `mesh-llm-nodejs`. Adjust the `if` expression
on the Linux tests job to no longer require `linux_inference_artifact_required
== 'true'` for these cases, and ensure the gate still respects
`linux_test_groups_json` and any truly required artifact dependency via the
relevant workflow outputs.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 325-338: The Linux tests workflow gate is too restrictive and
blocks valid matrix entries emitted by the changes computation. Update the job
condition on the Linux tests matrix so it matches the groups produced by
`compute-changes` in `.github/actions/compute-changes/action.yml`, especially
the new `sdk-api` groups from `mesh-llm-sdk`, `mesh-llm-cli`, `mesh-llm-tui`,
`mesh-llm-embedded-runtime`, and `mesh-llm-nodejs`. Adjust the `if` expression
on the Linux tests job to no longer require `linux_inference_artifact_required
== 'true'` for these cases, and ensure the gate still respects
`linux_test_groups_json` and any truly required artifact dependency via the
relevant workflow outputs.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3d88494c-ebfb-47cc-bae6-d361946992aa

📥 Commits

Reviewing files that changed from the base of the PR and between 29a2222 and 9d47784.

📒 Files selected for processing (6)

• .github/actionlint.yaml
• .github/actions/compute-changes/action.yml
• .github/workflows/ci.yml
• .github/workflows/pr_builds.yml
• .github/workflows/release.yml
• tools/xtask/src/main.rs