ci: run the work lanes on 32-core runners and merge the split jobs

[ethernet8023]

What does this PR do?

Every Linux lane that does real work ran on a 4-core ubuntu-latest. The
Python suite and the JS checks were split into many small jobs to make that
size usable. Each split job repeated the full setup. In most of the JS jobs
the repeated setup cost more than the work.

This PR moves the lanes that do work to larger runners. Then it removes the
splits that existed only to make small runners usable. Then it tunes what is
left, with measurements from the new hardware.

Runners. The work lanes move to ubuntu-latest-32-core. The arm64 image
build moves to ubuntu-latest-32-arm-core, because a build of linux/arm64 on
an x64 host uses emulation. .github/actionlint.yaml declares both labels.
actionlint knows the GitHub-hosted labels only, and an undeclared label reads
as an error that hides the real findings.

Python tests: 12 slices become 1 job on a 96-core runner. Slicing existed
to spread the suite over small runners. It cost a matrix job, a duration
cache, a per-slice artifact and a merge job. 96 cores clear the floor that the
slowest single test file sets, which is about 82s. A second slice divides work
that is already at that floor, and adds a second setup.

JS checks: 14 jobs become 1. The matrix paid about 371s of repeated setup
to spread about 612s of work. One larger runner installs one time. vitest, tsc
and eslint each size their own worker pool from the core count. The three UI
shard scripts and run-ui-shard.mjs are removed, because the unsharded
test:ui covers the same tests.

The JS unit of parallel work is a CHECK, and not a workspace. apps/desktop
is most of the payload, and its own check is a serial && chain. A spread
across workspaces alone therefore leaves that chain as the long pole. The loop
lives in .github/scripts/run-workspace-checks.mjs, so the same sequence runs
on a laptop. It runs 11 units together, buffers the output of each one, and
fails at the end with the full list. npm run --ws check stops at the first
failure.

Four tests depended on shared state, or on a timer that outlived them.
That was safe at 8 workers. It is not safe at 96 or more. They appear in runs
32547184159 and 32551746525:

• Every pytest subprocess shared one temp root. pytest walks that root at the
  end of a session with cleanup_dead_symlinks(). The walk lists the
  directory, asks whether the pytest-current symlink resolves, then unlinks
  it. A second process replaces that symlink between the question and the
  unlink. The first process then raises FileNotFoundError after all of its
  tests passed. Each subprocess now gets its own temp root.
• test_config_read_guard scanned the tree with rglob, which descends into
  __pycache__ trees that the guard never inspects. Sibling processes create
  and delete those entries during the run. The scan now uses os.walk and
  prunes before it descends.
• A PTY test waited for a file to exist, and not for its content. The child
  runs open(out,'wb').write(...), so open() creates the file empty and the
  bytes arrive later. The test now waits for the bytes.
• ConfirmDialog holds a "done" beat for 600ms, then calls onClose through
  window.setTimeout. The timer had no cleanup. An unmount inside that window
  left it armed, and it then reached setState on a tree that is gone. vitest
  tears the environment down first, so React read window during the update
  and threw ReferenceError: window is not defined. The handle now lives in a
  ref and clears on unmount. Zoomable had the same fault with a 1500ms
  timer.

The worker count comes from measurement. Run 32549672063 timed the whole
suite at six worker counts on the 96-core runner, two repetitions for each:

workers	x cores	rep 1	rep 2	mean
48	0.5x	138s	139s	138s
96	1.0x	127s	126s	126s
144	1.5x	130s	134s	132s
192	2.0x	132s	133s	132s
240	2.5x	140s	139s	140s
288	3.0x	143s	142s	142s

One worker for each core wins. The shape is the more useful result: 126s to
142s across a 6x range. The suite has sufficient concurrency at this machine
size. The remaining time belongs to the slowest individual files and to the
setup, so a future gain must come from those.

Related Issue

N/A — no issue. This work started from the CI times themselves.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• .github/workflows/tests.yml — one 96-core job for the whole Python suite,
  no slicing, HERMES_TEST_WORKERS: 96.
• .github/workflows/js-tests.yml — one 32-core job, node_modules cached on
  the lockfile, all checks run together.
• .github/scripts/run-workspace-checks.mjs — new. Runs every workspace check
  together and reports every failure.
• apps/desktop/package.json — explicit check:test:ui,
  check:test:desktop:platforms and check:test:desktop:all units.
  check:test:plugins joins the plain check script.
• .github/workflows/docker.yml — 32-core amd64, native 32-core arm64.
• .github/workflows/nix.yml, rust-tests.yml, e2e-desktop.yml — 32-core.
• .github/workflows/ci.yaml, tests-os.yml — runner labels.
• .github/actionlint.yaml — declares the two runner labels.
• scripts/run_tests_parallel.py — one pytest temp root for each subprocess.
• tests/hermes_cli/test_config_read_guard.py — os.walk with a prune.
• tests/tools/test_process_registry_write_stdin_surrogates.py — waits for
  the content of the file.
• apps/desktop/src/components/ui/confirm-dialog.tsx, zoomable.tsx — clear
  the pending timer on unmount.
• apps/desktop/src/components/ui/confirm-dialog-unmount.test.tsx — new.
  Confirms, unmounts inside the 600ms window, then advances the clock.
• Removed: apps/desktop/scripts/run-ui-shard.mjs and the three shard
  scripts.

How to Test

1. Read the checks of this PR. Every lane must pass on the new runners.
2. Run node .github/scripts/run-workspace-checks.mjs --list. It reports the
   11 units.
3. Run node .github/scripts/run-workspace-checks.mjs. Every check runs
   together, and the summary reports the time of each unit.
4. Run scripts/run_tests.sh. The Python suite passes.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: NixOS (Linux 7.1.8), and on the CI runners

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Verification

• actionlint reports 9 findings across all workflows. An unmodified HEAD with
  the same config reports the same 9. This change adds none.
• A wrong label still fails. actionlint reports ubuntu-latest-32-cor and
  ubuntu-latest-32-arm-cores.
• A replay of the save-durations merge step against a three-artifact layout
  returns all 3178 entries.
• An expansion of the npm script graph gives the same leaf commands for the
  parallel units and for a plain npm run check, in both directions. Against
  the 13-leg matrix the count is 13 to 11, and the whole difference is the
  three UI shards that collapse into one unsharded check:test:ui.
• A direct driver of _pytest.pathlib.cleanup_dead_symlinks against one
  shared root raises the same FileNotFoundError on pytest-current as CI. A
  private root for each subprocess removes that condition. 5 subprocesses
  receive 5 distinct roots, and no root survives the attempt.
• The config guard still catches a planted raw yaml.safe_load of
  config.yaml, and names the planted file.
• The old PTY wait loses 6 times in 25 runs on an idle 16-core machine. The
  new wait loses 0 times in 25.
• The PTY test cannot run on the NixOS development machine. That machine has
  no python3 outside the nix store, and the test uses the literal python3.
  The child exits 127 there. CI covers it.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on f62878b — perf(ci): set python test workers to one for each core, from}

⚠️ Warnings

OSV vulnerability scan · View job

7 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-71554 in uv.lock
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

ℹ️ Info

CI-sensitive file review · View job

PR touches sensitive files, but the ci-reviewed label has been added, approving them.

Sensitive files changed:

• .github/workflows/ci.yaml
• .github/workflows/docker.yml
• .github/workflows/e2e-desktop.yml
• .github/workflows/js-tests.yml
• .github/workflows/nix.yml
• .github/workflows/rust-tests.yml
• .github/workflows/tests-os.yml
• .github/workflows/tests.yml

---

debug info

CI timings

CI timings · View report · View job

Wall time 2m31s vs 3m52s (-34.9%). 12 job(s) slower, 3 faster, 2 unchanged.

• OS-specific tests / Windows-only tests: +19.0s
• Rust tests / cargo test (bootstrap installer): +13.0s
• Docs Site / docs-site-checks: -13.0s
• OS-specific tests / macOS-only tests: +8.0s
• Check contributors / check-attribution: -6.0s