Run mixed CI guards as parallel ownership groups

[teamleaderleo]

Summary

Split the 100+ step workflow-guard-tests serial lane into five concurrent ownership groups while keeping the same reusable-workflow job ID and aggregate result.

Groups:

• preflight: repository/config/schema/skill contracts that run before the Python 3.9 guard environment;
• ci: trust, routing, cache, merge-queue, and workflow contracts;
• app-host: xcodebuild/app-host/cache/test-runner contracts;
• release: TestFlight, nightly, Ghostty/Zig, notarization, Sparkle, and packaging contracts;
• quality: sharding, bundled-resource, virtual-display, shell, shortcut, and determinism checks.

The existing workflow-guard-tests job becomes a matrix, so guard-status still gets one fail-closed aggregate result and existing tests that inspect the job keep the same owner.

On the measured #13431 run the old mixed job was 191s wall time. The slowest independent checks included sharding (19s), determinism (19s), bundled resources (12s), iOS lane identity (10s), app-host retry (9s), virtual display (9s), and notarization (9s); this lets those run in parallel instead of serially.

Routing cleanup is separate in #13436. Web parallelism is separate in #13437.

Related: #13095, #13325.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Splits the 100+ step workflow-guard-tests lane into five concurrent matrix groups instead of one serial job, cutting the measured wall time from ~191s to the slowest group. The job keeps the same reusable-workflow ID and the fail-closed aggregate result guard-status relies on; each step is gated by matrix.group and a new test pins a representative step per group.

Matrix groups

• preflight: repository, config, schema, and skill contracts before the Python 3.9 setup.
• ci: trust, routing, cache, merge-queue, and workflow contracts.
• app-host: xcodebuild, app-host, cache, and test-runner contracts.
• release: TestFlight, nightly, Ghostty/Zig, notarization, Sparkle, and packaging contracts.
• quality: sharding, bundled-resource, virtual-display, shell, shortcut, and determinism checks.

Bun setup now runs unconditionally so every group can cover contracts that need it.

^{Written for commit 99aebb9. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 19 seconds.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6795307e-6a2a-4595-b3ee-3b45336619ef

📥 Commits

Reviewing files that changed from the base of the PR and between d42ce20 and 99aebb9.

📒 Files selected for processing (2)

• .github/workflows/ci-guards.yml
• tests/test_ci_change_areas.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}