fix(ci): keep qwen-autofix.yml under GitHub's 500 KB start-runs limit

.github/scripts/check-workflow-size.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# GitHub does not START RUNS for a workflow file larger than 500 KB (512,000
+# bytes), and it says nothing when it stops: schedule ticks vanish, dispatches
+# sit "queued" forever with zero jobs, `issues`/`issue_comment` go quiet, and
+# only PR-event runs keep working — those resolve the workflow from the PR's
+# own branch, so an older, smaller copy runs and the workflow looks half-alive.
+# qwen-autofix.yml crossed the line on 2026-08-19 and the autofix loop went
+# dark for a day before anyone read the size.
+#
+# The gate below sits well under the real ceiling on purpose: a PR that trips
+# it still has room to land the fix, instead of discovering the wall with no
+# space left to move prose out.
+set -uo pipefail
+
+GITHUB_LIMIT_BYTES=512000
+GATE_BYTES="${WORKFLOW_SIZE_GATE_BYTES:-470000}"
+WARN_BYTES=$((GATE_BYTES - 25000))
+
+status=0
+shopt -s nullglob
+for file in .github/workflows/*.yml .github/workflows/*.yaml; do
+  if ! size="$(wc -c <"${file}")"; then
+    echo "::error file=${file}::unable to read ${file}"
+    status=1
+    continue
+  fi
+  pct=$((size * 100 / GITHUB_LIMIT_BYTES))
+  if ((size > GATE_BYTES)); then
+    echo "::error file=${file}::${file} is ${size} bytes — ${pct}% of GitHub's ${GITHUB_LIMIT_BYTES}-byte start-runs limit, past this repo's ${GATE_BYTES}-byte gate. Move prose into a sibling .md and long steps into .github/scripts/; do not raise the gate."
+    status=1
+  elif ((size > WARN_BYTES)); then
+    echo "::warning file=${file}::${file} is ${size} bytes (${pct}% of GitHub's limit) — approaching the ${GATE_BYTES}-byte gate."
+  fi
+done
+
+if ((status == 0)); then
+  echo "✅ every workflow file is under the ${GATE_BYTES}-byte gate"
+fi
+exit "${status}"

.github/workflows/ci.yml

@@ -289,6 +289,15 @@ jobs:
           echo "ci_profile=${profile}" >> "${GITHUB_OUTPUT}"
           echo "Selected CI profile: ${profile}"
 
+      # Deliberately gated on skip_ci ONLY, not on the CI profile: a PR that
+      # touches nothing but .github/ classifies as `github_ci_only`, and that
+      # is exactly the PR most likely to push a workflow file past GitHub's
+      # 500 KB start-runs limit — the limit that silently killed the autofix
+      # loop for a day on 2026-08-19. Costs one `wc -c` per workflow file.
+      - name: 'Check workflow file size'
+        if: "${{ needs.classify_pr.outputs.skip_ci != 'true' }}"
+        run: '.github/scripts/check-workflow-size.sh'
+
       - name: 'Docs-only CI'
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && steps.ci_profile.outputs.ci_profile == 'docs_only' }}"
         run: 'echo "Docs-only change; full CI skipped."'

scripts/tests/qwen-autofix-workflow.test.js

@@ -22,6 +22,10 @@ import { describe, expect, it } from 'vitest';
 import { getWorkflowJob } from './workflow-helpers.js';
 
 const workflow = readFileSync('.github/workflows/qwen-autofix.yml', 'utf8');
+// Long-form rationale moved out of the YAML when the file approached
+// GitHub's 500 KB start-runs limit; assertions that pin a REASON (rather
+// than a code line) read it here.
+const designDoc = readFileSync('.github/workflows/qwen-autofix.md', 'utf8');
 const ciWorkflow = readFileSync('.github/workflows/ci.yml', 'utf8');
 const releaseWorkflow = readFileSync('.github/workflows/release.yml', 'utf8');
 const sandboxImageResolverScript = readFileSync(
@@ -3864,13 +3868,11 @@ describe('qwen-autofix workflow', () => {
     // idle candidates hit `continue` before the TARGETS append, so they
     // never contend for it; the real win is inspection budget + walk
     // latency, and the comment says so.
-    expect(reviewScanJob).toContain(
-      'Idle PRs never reach the\n          # 10-target budget',
-    );
+    expect(designDoc).toContain('Idle PRs never reach the\n10-target budget');
     // The two scan-only signals updatedAt cannot see are named, not
     // papered over by an absolute invariant.
-    expect(reviewScanJob).toContain('base conflict');
-    expect(reviewScanJob).toContain('still-red checks');
+    expect(designDoc).toContain('base conflict');
+    expect(designDoc).toContain('still-red checks');
   });
 
   it('fails closed on busy-enumeration failure, keeps explicit dispatches, and signals the issue phase', () => {

scripts/tests/workflow-size.test.js

@@ -0,0 +1,81 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+// GitHub does not start runs for a workflow file over 500 KB (512,000 bytes)
+// and reports nothing when it stops — see .github/scripts/check-workflow-size.sh
+// and .github/workflows/qwen-autofix.md for the incident this encodes.
+const GITHUB_LIMIT_BYTES = 512_000;
+const WORKFLOW_DIR = '.github/workflows';
+const gateScript = readFileSync(
+  '.github/scripts/check-workflow-size.sh',
+  'utf8',
+);
+const ciWorkflow = readFileSync(join(WORKFLOW_DIR, 'ci.yml'), 'utf8');
+
+const gateBytes = Number(
+  gateScript.match(/GATE_BYTES="\$\{WORKFLOW_SIZE_GATE_BYTES:-(\d+)\}"/)?.[1],
+);
+
+const workflowFiles = readdirSync(WORKFLOW_DIR)
+  .filter((name) => name.endsWith('.yml') || name.endsWith('.yaml'))
+  .map((name) => join(WORKFLOW_DIR, name));
+
+describe('workflow file size', () => {
+  it('keeps the gate below GitHub 500 KB start-runs limit', () => {
+    expect(gateBytes).toBeGreaterThan(0);
+    expect(gateBytes).toBeLessThan(GITHUB_LIMIT_BYTES);
+  });
+
+  it.each(workflowFiles)('%s stays under the gate', (file) => {
+    const bytes = Buffer.byteLength(readFileSync(file));
+    expect(bytes).toBeLessThan(gateBytes);
+  });
+
+  it('runs the gate on every CI profile, not just full', () => {
+    // A .github-only PR classifies as `github_ci_only`; gating the check on the
+    // `full` profile would skip it for exactly the changes that can trip it.
+    const step = ciWorkflow.match(
+      /- name: 'Check workflow file size'[\s\S]*?run: '(.+?)'/,
+    );
+    expect(step?.[1]).toBe('.github/scripts/check-workflow-size.sh');
+    expect(step?.[0]).toContain(
+      'if: "${{ needs.classify_pr.outputs.skip_ci != \'true\' }}"',
+    );
+    expect(step?.[0]).not.toContain('ci_profile');
+  });
+});
+
+describe('qwen-autofix.yml design-record pointers', () => {
+  const workflow = readFileSync(join(WORKFLOW_DIR, 'qwen-autofix.yml'), 'utf8');
+  const doc = readFileSync(join(WORKFLOW_DIR, 'qwen-autofix.md'), 'utf8');
+
+  const pointers = [...workflow.matchAll(/qwen-autofix\.md#(af-\d+)/g)].map(
+    (m) => m[1],
+  );
+  const anchors = [...doc.matchAll(/<a id="(af-\d+)"><\/a>/g)].map((m) => m[1]);
+
+  it('every pointer resolves to a section', () => {
+    expect(pointers.length).toBeGreaterThan(0);
+    expect(
+      [...new Set(pointers)].filter((id) => !anchors.includes(id)),
+    ).toEqual([]);
+  });
+
+  it('every section is still pointed at from the workflow', () => {
+    expect(anchors.filter((id) => !pointers.includes(id))).toEqual([]);
+  });
+
+  it('lists every section in the contents table', () => {
+    const listed = [...doc.matchAll(/^- \[\d+\..*?\]\(#(af-\d+)\)$/gm)].map(
+      (m) => m[1],
+    );
+    expect(listed).toEqual(anchors);
+  });
+});