ci: start guards and web beside Fast static checks

[teamleaderleo]

Summary

macOS compile admission starts only after macos-admission-gate, and the gate waits for every fast Linux-only job. On every sampled pull-request run, the guards finished last. The gate opened 117–133 s after changes started:

Step on the critical path	Time
changes	~18 s
Fast static checks (static-preflight)	~23 s
slowest guard leg	~75–85 s
Guard status	~6–14 s

Both guards and web needed static-preflight, so they waited for it before starting. They now start alongside it. On web PRs, web finishes after the guards (+133 s in one sample), so it moves too.

This does not change what is admitted. The gate and the macos call still require needs.static-preflight.result == 'success', so macOS never starts on a diff that the static checks reject. The cost is guard and web runner time on such diffs, which are rare.

Expected: the gate opens about 25 s sooner, which saves about 25 s on every PR that reaches macOS and on Linux-only PRs where guards are the slowest check.

Testing

• The first commit rewrites the two tests that pinned needs: [changes, static-preflight] for guards and web. The guards test also asserts the gate still needs static-preflight. Both fail on main.
• With the fix: tests/test_ci_change_areas.py and tests/test_ci_linux_guard_routing.py pass, including test_macos_admission_gate_needs_every_fast_linux_only_job, which derives the gate's needs. actionlint is clean.

Related: #14169 (sidebar-layout leg) and #14170 (profiling leg) shorten two of the slow guard legs.

🤖 Generated with Claude Code

---

Summary by cubic

Starts guards and web runs beside the fast static checks instead of waiting for them, opening the macOS admission gate about 25 s sooner. The gate still requires static-preflight to succeed, so macOS still never starts on a diff the static checks reject—the only cost is runner time on such diffs, which are rare. Updates the tests that pinned the old needs: [changes, static-preflight] ordering and asserts the gate keeps its requirement.

^{Written for commit 4f8a219. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f1447c53-0e64-43d4-9b9a-d45b7ffb534f

📥 Commits

Reviewing files that changed from the base of the PR and between c0325cd and 4f8a219.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• tests/test_ci_change_areas.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[teamleaderleo]

An independent review at 4f8a219 found no problems.

• What guards and web used to wait for: every job that needs guards or web also lists static-preflight directly. That covers macos-admission-gate, tests, linux-preflight and ci-status, so a static failure still turns ci-status red and still keeps macOS from starting.
• Side effects: ci-guards.yml and ci-web.yml have contents: read only, no secrets and no deploys. The only new cost is guard and web runner time on diffs that fail static checks.
• Gate needs: the derived set is unchanged.

Auto-merge (squash) is on. I'll measure the gate's opening time on a few PRs after this lands.