ci: stop routing workflow plumbing changes to macOS

.github/workflows/ci.yml

@@ -50,6 +50,13 @@ jobs:
           if [ "$EVENT_NAME" = "pull_request" ] || [ "$EVENT_NAME" = "merge_group" ]; then
             # Checkout depth 2 contains the synthetic merge commit and its
             # base parent, even when base/head histories are shallow boundaries.
+            # The event's base SHA is where the pull request last synced. Once
+            # main moves on it is outside this checkout, and a diff from it
+            # would also count everything main gained since. The merge commit's
+            # first parent is the base it was actually built on.
+            if git rev-parse -q --verify "$MERGE_SHA^2" > /dev/null; then
+              BASE_SHA="$(git rev-parse "$MERGE_SHA^1")"
+            fi
             if ! git diff --name-only "$BASE_SHA" "$MERGE_SHA" > /tmp/cmux-ci-changed-files.txt; then
               echo "Could not compute PR diff; running all CI areas." >&2
               emit_all_areas
@@ -72,6 +79,7 @@ jobs:
             ghosttykit_guard_only=true
             has_ghosttykit_guard_file=false
             ci_router_changed=false
+            ci_workflow_changed=false
             while IFS= read -r changed_file; do
               case "$changed_file" in
                 ghostty|scripts/download-prebuilt-ghosttykit.sh|scripts/validate-xcframework-archive.py|scripts/ghosttykit-checksums.txt|tests/test_ci_ghosttykit_release_check.sh)
@@ -81,7 +89,7 @@ jobs:
                   ci_router_changed=true
                   ;;
                 .github/workflows/ci.yml)
-                  ci_router_changed=true
+                  ci_workflow_changed=true
                   ;;
                 scripts/ci/*)
                   ci_router_changed=true
@@ -111,9 +119,23 @@ jobs:
               exit 0
             fi
 
+            # The detector is unchanged here, so it may judge a ci.yml edit: only
+            # an edit confined to Linux jobs skips macOS, and anything it cannot
+            # read runs every area.
+            workflow_base_args=()
+            if [ "$ci_workflow_changed" = true ]; then
+              if ! git show "$BASE_SHA:.github/workflows/ci.yml" > /tmp/cmux-ci-base-workflow.yml; then
+                echo "Could not read the base ci.yml; running all CI areas." >&2
+                emit_all_areas
+                exit 0
+              fi
+              workflow_base_args=(--ci-workflow-base /tmp/cmux-ci-base-workflow.yml)
+            fi
+
             python3 scripts/ci/detect_ci_change_areas.py \
               --event-name "$EVENT_NAME" \
-              --files-from /tmp/cmux-ci-changed-files.txt
+              --files-from /tmp/cmux-ci-changed-files.txt \
+              ${workflow_base_args[@]+"${workflow_base_args[@]}"}
             exit 0
           fi
 
@@ -485,7 +507,26 @@ jobs:
         run: bunx playwright install --with-deps chromium
 
       - name: Instant navigation tests
-        run: bun run test:instant
+        run: |
+          set -o pipefail
+          log="$RUNNER_TEMP/web-test-instant.log"
+          set +e
+          bun run test:instant 2>&1 | tee "$log"
+          status=${PIPESTATUS[0]}
+          set -e
+
+          # The native TypeScript preview compiler can abort while Playwright
+          # starts its web server. Retry that transient compiler crash once,
+          # while preserving immediate failures for real type or test errors.
+          if [ "$status" -ne 0 ] \
+            && grep -Fq '[WebServer] $ tsgo --noEmit' "$log" \
+            && grep -Fq 'Aborted (core dumped)' "$log"; then
+            echo "::warning::native tsgo aborted during instant navigation tests; retrying once"
+            bun run test:instant
+            exit $?
+          fi
+
+          exit "$status"
 
   # Checks for in-app React webviews (currently the diff viewer; more cmux React
   # surfaces will live alongside it).

.github/workflows/perf-activation.yml

@@ -85,9 +85,9 @@ jobs:
               exit 0
             fi
 
-            # This guard runs before the PR-editable Python detector. Workflow
-            # and detector edits must fail open to the benchmark.
-            if grep -Eq '^(\.github/workflows/[^/]+\.ya?ml|scripts/ci/[^/]+\.py|tests/test_ci_change_areas\.py)$' /tmp/cmux-activation-changed-files.txt; then
+            # This guard runs before the PR-editable Python detector. Edits to
+            # this workflow and to the detector must fail open to the benchmark.
+            if grep -Eq '^(\.github/workflows/perf-activation\.ya?ml|scripts/ci/[^/]+\.py|tests/test_ci_change_areas\.py)$' /tmp/cmux-activation-changed-files.txt; then
               echo "CI router changed; running activation benchmark."
               emit_all_areas
               exit 0

scripts/ci/detect_ci_change_areas.py

@@ -5,6 +5,7 @@
 
 import argparse
 import os
+import re
 import subprocess
 import sys
 from dataclasses import dataclass
@@ -41,16 +42,137 @@ def normalize_path(path: str) -> str:
     return normalized
 
 
-def is_workflow(path: str) -> bool:
-    return path.startswith(".github/workflows/")
+CI_WORKFLOW_PATH = ".github/workflows/ci.yml"
+
+
+def is_other_workflow_config(path: str) -> bool:
+    # ci.yml's macOS and web jobs read no other workflow file. An edit to one is
+    # checked by workflow-guard-tests and by that workflow's own triggers.
+    if path == CI_WORKFLOW_PATH:
+        return False
+    return path.startswith(".github/workflows/") or path == ".github/actionlint.yaml"
 
 
 def forces_all_areas(path: str) -> bool:
     ci_script_prefix = "scripts/ci/"
     is_direct_ci_python = path.startswith(ci_script_prefix) and path.endswith(".py")
     if is_direct_ci_python:
         is_direct_ci_python = "/" not in path[len(ci_script_prefix) :]
-    return is_workflow(path) or is_direct_ci_python or path == "tests/test_ci_change_areas.py"
+    return path == CI_WORKFLOW_PATH or is_direct_ci_python or path == "tests/test_ci_change_areas.py"
+
+
+_TEST_REFERENCE_RE = re.compile(r"tests/[A-Za-z0-9_./-]*")
+
+
+def is_plainly_linux_runner(runs_on: str) -> bool:
+    # Anything else counts as macOS: a matrix or needs expression, a list or
+    # group on the following lines, or a label this does not recognize.
+    value = runs_on.strip()
+    if not value or re.search(r"macos|matrix\.|needs\.|inputs\.", value, re.IGNORECASE):
+        return False
+    return bool(re.search(r"LINUX_RUNNER|LINUX_ARM64_RUNNER|ubuntu", value))
+
+
+_JOB_SPLIT_RE = re.compile(r"(?m)^  (?=[A-Za-z0-9_-]+:\s*$)")
+
+# `changes` routes every other job and `ci-status` is the required gate, so an
+# edit to either always runs every area.
+_ROUTING_JOBS = frozenset({"changes", "ci-status"})
+
+
+def split_workflow_jobs(workflow: str) -> Optional[tuple[str, dict[str, str]]]:
+    """Return the text before `jobs:` and each job's block, or None if unreadable."""
+    preamble, found, body = workflow.partition("\njobs:\n")
+    if not found:
+        return None
+    jobs: dict[str, str] = {}
+    for block in _JOB_SPLIT_RE.split(body):
+        name, _, _ = block.partition(":")
+        if not block.strip():
+            continue
+        if not re.fullmatch(r"[A-Za-z0-9_-]+", name) or name in jobs:
+            return None
+        jobs[name] = block
+    return (preamble, jobs) if jobs else None
+
+
+def job_is_plainly_linux(block: str) -> bool:
+    runs_on = re.search(r"(?m)^    runs-on:[ \t]*(.*)$", block)
+    return bool(runs_on) and is_plainly_linux_runner(runs_on.group(1))
+
+
+def ci_workflow_change_is_linux_only(base: str, head: str) -> bool:
+    """True when base and head ci.yml differ only in jobs that run on Linux.
+
+    Triggers, env, permissions and concurrency live before `jobs:` and reach
+    every job, so any change there is not Linux-only. Unreadable input and an
+    unchanged file are not Linux-only either, so the caller fails open.
+    """
+    base_parts = split_workflow_jobs(base)
+    head_parts = split_workflow_jobs(head)
+    if base_parts is None or head_parts is None:
+        return False
+    (base_preamble, base_jobs), (head_preamble, head_jobs) = base_parts, head_parts
+    if base_preamble != head_preamble:
+        return False
+    changed = {
+        name
+        for name in base_jobs.keys() | head_jobs.keys()
+        if base_jobs.get(name) != head_jobs.get(name)
+    }
+    if not changed or changed & _ROUTING_JOBS:
+        return False
+    return all(
+        job_is_plainly_linux(jobs[name])
+        for name in changed
+        for jobs in (base_jobs, head_jobs)
+        if name in jobs
+    )
+
+
+def macos_job_test_references(workflow: str) -> Optional[tuple[frozenset[str], frozenset[str]]]:
+    """Return the tests/ paths ci.yml names in non-Linux jobs and in all jobs.
+
+    A macOS job that runs tests through a glob yields the glob's literal prefix.
+    Returns None when the jobs cannot be read, so the caller fails open.
+    """
+    _, found, body = workflow.partition("\njobs:\n")
+    if not found:
+        return None
+    macos: set[str] = set()
+    everywhere: set[str] = set()
+    jobs = 0
+    for block in re.split(r"(?m)^  (?=[A-Za-z0-9_-]+:\s*$)", body):
+        runs_on = re.search(r"(?m)^    runs-on:[ \t]*(.*)$", block)
+        if not runs_on:
+            continue
+        jobs += 1
+        references = set(_TEST_REFERENCE_RE.findall(block))
+        everywhere |= references
+        if not is_plainly_linux_runner(runs_on.group(1)):
+            macos |= references
+    if jobs == 0:
+        return None
+    return frozenset(macos), frozenset(everywhere)
+
+
+def load_macos_job_test_references() -> Optional[tuple[frozenset[str], frozenset[str]]]:
+    try:
+        return macos_job_test_references(Path(CI_WORKFLOW_PATH).read_text(encoding="utf-8"))
+    except OSError:
+        return None
+
+
+def is_guard_only_test(path: str, references: Optional[tuple[frozenset[str], frozenset[str]]]) -> bool:
+    # A tests/ file is macOS-neutral only when ci.yml names it and every job
+    # that names it runs on Linux. An unnamed file may be imported by a test a
+    # macOS job runs, so it stays macOS-relevant.
+    if references is None or not path.startswith("tests/"):
+        return False
+    macos, everywhere = references
+    if path not in everywhere:
+        return False
+    return not any(path.startswith(reference) for reference in macos)
 
 
 def is_web_change(path: str) -> bool:
@@ -111,7 +233,14 @@ def is_macos_neutral(path: str) -> bool:
         )
     ):
         return True
-    return path == "README.md" or (path.startswith("README.") and path.endswith(".md"))
+    if path == "README.md" or (path.startswith("README.") and path.endswith(".md")):
+        return True
+    # Agent instructions at any depth, and skill documentation. The app bundles
+    # skills/cmux-cua as a folder resource, and skill scripts and manifests are
+    # executable inputs, so only Markdown outside that folder is neutral.
+    if path.rsplit("/", 1)[-1] in {"CLAUDE.md", "AGENTS.md"}:
+        return True
+    return path.startswith("skills/") and path.endswith(".md") and not path.startswith("skills/cmux-cua/")
 
 
 def is_macos_change(path: str) -> bool:
@@ -126,20 +255,25 @@ def is_macos_change(path: str) -> bool:
     return not is_macos_neutral(path)
 
 
-def classify_files(paths: Iterable[str]) -> ChangeAreas:
+def classify_files(paths: Iterable[str], *, ci_workflow_linux_only: bool = False) -> ChangeAreas:
     macos = False
     web = False
     agent_session_web = False
+    test_references = load_macos_job_test_references()
 
     for raw_path in paths:
         path = normalize_path(raw_path)
         if not path:
             continue
+        if path == CI_WORKFLOW_PATH and ci_workflow_linux_only:
+            continue
         if forces_all_areas(path):
             macos = True
             web = True
             agent_session_web = True
             continue
+        if is_other_workflow_config(path) or is_guard_only_test(path, test_references):
+            continue
         if is_web_change(path):
             web = True
         if is_agent_session_web_change(path):
@@ -154,6 +288,19 @@ def classify_files(paths: Iterable[str]) -> ChangeAreas:
     )
 
 
+def ci_workflow_linux_only(base_path: Optional[Path]) -> bool:
+    if base_path is None:
+        return False
+    try:
+        base = base_path.read_text(encoding="utf-8")
+        head = Path(CI_WORKFLOW_PATH).read_text(encoding="utf-8")
+    except OSError:
+        return False
+    linux_only = ci_workflow_change_is_linux_only(base, head)
+    print(f"ci.yml changed; only Linux jobs differ: {bool_output(linux_only)}")
+    return linux_only
+
+
 def run_git(args: list[str]) -> str:
     return subprocess.check_output(["git", *args], text=True, stderr=subprocess.STDOUT).strip()
 
@@ -182,6 +329,11 @@ def parse_args(argv: list[str]) -> argparse.Namespace:
         default=os.environ.get("GITHUB_OUTPUT"),
         help="Path to append GitHub Actions step outputs to.",
     )
+    parser.add_argument(
+        "--ci-workflow-base",
+        type=Path,
+        help="The base revision of ci.yml, to compare its jobs with the checked-out one.",
+    )
     parser.add_argument(
         "--files-from",
         type=Path,
@@ -209,7 +361,7 @@ def main(argv: list[str]) -> int:
                 raise RuntimeError("pull_request event is missing base/head SHA")
             files = changed_files(args.base_sha, args.head_sha)
         if files:
-            areas = classify_files(files)
+            areas = classify_files(files, ci_workflow_linux_only=ci_workflow_linux_only(args.ci_workflow_base))
         else:
             areas = ChangeAreas.all()
             print("PR diff is empty; running all CI areas.")

scripts/ci/web_validation.py

@@ -14,15 +14,44 @@
 
 def requires_web(paths: list[str]) -> bool:
     return classify_files(paths).web or any(
-        path in {".vercelignore", "vercel.json", "bunfig.toml", ".npmrc", "tests/test_web_validation.py"}
+        path
+        in {
+            ".vercelignore",
+            "vercel.json",
+            "bunfig.toml",
+            ".npmrc",
+            "tests/test_web_validation.py",
+            # The CI router treats other workflow files as neutral, so this
+            # gate names its own.
+            ".github/workflows/web-validation.yml",
+        }
         or path.startswith(("config/", "workers/"))
         for path in paths
     )
 
 
+def merge_parent(head: str) -> str:
+    """Return the base a pull request's synthetic merge commit was built on.
+
+    The event's base SHA is where the pull request last synced. Once main
+    moves on it is outside the depth-2 checkout, and a diff from it would also
+    count what main gained since.
+    """
+    def resolve(revision: str) -> str:
+        result = subprocess.run(
+            ["git", "rev-parse", "-q", "--verify", revision], text=True, capture_output=True
+        )
+        return result.stdout.strip() if result.returncode == 0 else ""
+
+    # Only a merge commit has a second parent.
+    return resolve(f"{head}^1") if resolve(f"{head}^2") else ""
+
+
 def required_for_event(event: str, base: str, head: str) -> bool:
     if event not in {"pull_request", "push"} or not base or not head:
         return True
+    if event == "pull_request":
+        base = merge_parent(head) or base
     try:
         paths = subprocess.check_output(
             ["git", "diff", "--no-renames", "--name-only", "-z", base, head, "--"], text=True,