Route Linux guard tests by owning group

.github/workflows/ci-guards.yml

@@ -6,6 +6,9 @@ on:
       linux_guard_tests:
         required: true
         type: string
+      linux_guard_test_groups:
+        required: true
+        type: string
       linux_guard_history:
         required: true
         type: string
@@ -26,7 +29,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        group: [preflight, ci, app-host-execution, app-host-process, app-host-cache, release-ios, release-notary, release-tooling, quality-sharding, quality-runtime, quality-determinism]
+        group: ${{ fromJSON(inputs.linux_guard_test_groups) }}
     runs-on: ${{ vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
     # This job executes scripts from the pull request. It needs only read
     # access for checkout, never workflow, issue, or repository write access.

.github/workflows/ci.yml

@@ -49,6 +49,7 @@ jobs:
       agent_session_web: ${{ steps.detect.outputs.agent_session_web }}
       release_build: ${{ steps.detect.outputs.release_build }}
       linux_guard_tests: ${{ steps.linux_guards.outputs.linux_guard_tests }}
+      linux_guard_test_groups: ${{ steps.linux_guards.outputs.linux_guard_test_groups }}
       linux_guard_history: ${{ steps.linux_guards.outputs.linux_guard_history }}
       linux_guard_cli: ${{ steps.linux_guards.outputs.linux_guard_cli }}
       linux_guard_source: ${{ steps.linux_guards.outputs.linux_guard_source }}
@@ -254,10 +255,11 @@ jobs:
           if [ -f /tmp/cmux-ci-changed-files.txt ]; then
             while IFS= read -r path; do
               case "$path" in
-                .github/workflows/ci.yml|scripts/ci/detect_ci_change_areas.py|scripts/ci/detect_linux_guard_changes.py|tests/test_ci_change_areas.py|tests/test_ci_linux_guard_routing.py)
+                .github/workflows/ci.yml|.github/workflows/ci-guards.yml|scripts/ci/detect_ci_change_areas.py|scripts/ci/detect_linux_guard_changes.py|scripts/ci/workflow_guard_groups.py|tests/test_ci_change_areas.py|tests/test_ci_linux_guard_routing.py|tests/test_ci_guard_workflow_structure.py|tests/test_ci_app_host_guard_structure.py|tests/test_ci_quality_guard_structure.py|tests/test_ci_release_guard_structure.py)
                   for route in linux_guard_tests linux_guard_history linux_guard_cli linux_guard_source ghosttykit_release; do
                     echo "$route=true" >> "$GITHUB_OUTPUT"
                   done
+                  echo 'linux_guard_test_groups=["preflight","ci","app-host-execution","app-host-process","app-host-cache","release-ios","release-notary","release-tooling","quality-sharding","quality-runtime","quality-determinism"]' >> "$GITHUB_OUTPUT"
                   exit 0
                   ;;
               esac
@@ -404,6 +406,7 @@ jobs:
     uses: ./.github/workflows/ci-guards.yml
     with:
       linux_guard_tests: ${{ needs.changes.outputs.linux_guard_tests }}
+      linux_guard_test_groups: ${{ needs.changes.outputs.linux_guard_test_groups }}
       linux_guard_history: ${{ needs.changes.outputs.linux_guard_history }}
       linux_guard_cli: ${{ needs.changes.outputs.linux_guard_cli }}
       linux_guard_source: ${{ needs.changes.outputs.linux_guard_source }}

scripts/ci/detect_linux_guard_changes.py

@@ -4,8 +4,11 @@
 from __future__ import annotations
 
 import argparse
+import json
 from pathlib import Path
 
+from workflow_guard_groups import GROUPS, groups_for_path
+
 
 ROUTES = (
     "linux_guard_tests", "linux_guard_history", "linux_guard_cli",
@@ -98,6 +101,30 @@ def classify(paths: list[str], *, event: str, macos: str) -> dict[str, bool]:
     return routes
 
 
+def classify_test_groups(paths: list[str], *, event: str, macos: str) -> tuple[str, ...]:
+    """Select only workflow-guard-tests groups that can observe this diff."""
+    if event != "pull_request" or macos not in {"true", "false"} or not paths:
+        return GROUPS
+
+    selected: set[str] = set()
+    for path in paths:
+        if not path or path.startswith("/") or ".." in path.split("/"):
+            return GROUPS
+        if plain_documentation(path):
+            continue
+        owners = groups_for_path(path)
+        if owners is None:
+            return GROUPS
+        selected.update(owners)
+
+    # linux_guard_tests skips documentation-only diffs. Keep a valid non-empty
+    # matrix value available anyway so malformed callers cannot create an empty
+    # matrix-expansion failure.
+    if not selected:
+        return GROUPS
+    return tuple(group for group in GROUPS if group in selected)
+
+
 def main() -> None:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--event-name", required=True)
@@ -108,8 +135,11 @@ def main() -> None:
         paths = args.files_from.read_text(encoding="utf-8").splitlines()
     except (OSError, UnicodeError):
         paths = []
-    for name, enabled in classify(paths, event=args.event_name, macos=args.macos).items():
+    routes = classify(paths, event=args.event_name, macos=args.macos)
+    for name, enabled in routes.items():
         print(f"{name}={'true' if enabled else 'false'}")
+    groups = classify_test_groups(paths, event=args.event_name, macos=args.macos)
+    print(f"linux_guard_test_groups={json.dumps(groups, separators=(',', ':'))}")
 
 
 if __name__ == "__main__":