ci: aggregate required gates (stop branch-protection desync on renames/splits)

.github/workflows/ci.yml

@@ -336,7 +336,7 @@ jobs:
           DIRECT_DATABASE_URL: postgres://cmux:cmux@localhost:5432/cmux_test
         run: bun run test:db:behavior
 
-  tests:
+  app-host-unit-tests:
     needs: changes
     if: ${{ needs.changes.outputs.macos == 'true' }}
     name: app-host unit tests (${{ matrix.shard }}/4)
@@ -663,11 +663,18 @@ jobs:
           CMUX_CLI_BIN="$CLI_BIN" python3 tests/test_pi_extension_install.py
           CMUX_CLI_BIN="$CLI_BIN" python3 tests/test_omp_extension_install.py
 
-  tests-required-status:
+  tests:
     name: tests
+    # Aggregate gate for the test/build suites in this workflow. Required by
+    # branch protection under the stable name "tests", and references each suite
+    # by its job KEY via needs:, so renaming/sharding a job's display name never
+    # desyncs the required-checks list (the failure mode from the #6464 sharding
+    # that stranded the old "tests" check). Add new ci.yml test/build jobs here.
     needs:
       - changes
-      - tests
+      - app-host-unit-tests
+      - swift-package-tests
+      - agent-session-web-resources
     if: ${{ always() }}
     runs-on: ${{ vars.LINUX_RUNNER || 'warp-ubuntu-latest-x64-4x' }}
     timeout-minutes: 5
@@ -683,7 +690,7 @@ jobs:
 
           needs = json.loads(os.environ["TESTS_NEEDS"])
           changes = needs["changes"]
-          tests = needs["tests"]
+          tests = needs["app-host-unit-tests"]
           macos = changes.get("outputs", {}).get("macos")
 
           if changes["result"] != "success":
@@ -698,8 +705,20 @@ jobs:
               print(f"app-host unit tests had unexpected result for macos={macos}: {tests['result']}", file=sys.stderr)
               sys.exit(1)
 
+          # The remaining test/build suites in this workflow gate too. A job that
+          # opts out via its own path filter reports "skipped", which is fine; a
+          # job that actually ran and failed must block the merge.
+          allowed = {"success", "skipped"}
+          for name in ("swift-package-tests", "agent-session-web-resources"):
+              result = needs[name]["result"]
+              if result not in allowed:
+                  print(f"{name} did not pass: {result}", file=sys.stderr)
+                  sys.exit(1)
+
           print(f"changes.macos={macos}")
           print(f"app-host unit tests={tests['result']}")
+          for name in ("swift-package-tests", "agent-session-web-resources"):
+              print(f"{name}={needs[name]['result']}")
           PY
 
   swift-package-tests:
@@ -1894,8 +1913,8 @@ jobs:
       - web-typecheck
       - react-apps-check
       - web-db-migrations
+      - app-host-unit-tests
       - tests
-      - tests-required-status
       - swift-package-tests
       - agent-session-web-resources
       - tests-build-and-lag

.github/workflows/test-ios.yml

@@ -364,3 +364,52 @@ jobs:
             fi
             exit "$status"
           done
+
+  ios-tests:
+    name: ios-tests
+    # Aggregate gate for this workflow's iOS suites. Add this check to the branch
+    # protection required list (it is the iOS sibling of ci.yml's "tests" gate).
+    # References each suite by job KEY via needs:, so renaming or sharding a job
+    # never desyncs the required-checks list. Add new iOS jobs to needs: here.
+    needs:
+      - detect-ios-changes
+      - package-conventions-lint
+      - mobile-core-package
+      - ios-simulator
+    if: ${{ always() }}
+    runs-on: ${{ vars.LINUX_RUNNER || 'warp-ubuntu-latest-x64-4x' }}
+    timeout-minutes: 5
+    steps:
+      - name: Check iOS test routing
+        env:
+          IOS_NEEDS: ${{ toJSON(needs) }}
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import sys
+
+          needs = json.loads(os.environ["IOS_NEEDS"])
+
+          # The routing job must succeed for its should_run/should_lint outputs to
+          # be trustworthy; the suites below run or skip based on those outputs.
+          if needs["detect-ios-changes"]["result"] != "success":
+              print(f"detect-ios-changes: {needs['detect-ios-changes']['result']}", file=sys.stderr)
+              sys.exit(1)
+
+          # A suite that opted out via the routing filter reports "skipped", which
+          # is fine; a suite that actually ran and failed must block the merge.
+          allowed = {"success", "skipped"}
+          bad = {
+              name: data["result"]
+              for name, data in sorted(needs.items())
+              if name != "detect-ios-changes" and data["result"] not in allowed
+          }
+          if bad:
+              for name, result in bad.items():
+                  print(f"{name} did not pass: {result}", file=sys.stderr)
+              sys.exit(1)
+
+          for name, data in sorted(needs.items()):
+              print(f"{name}={data['result']}")
+          PY

tests/test_ci_change_areas.py

@@ -393,8 +393,8 @@ def test_ci_status_job_accepts_skipped_routed_jobs() -> None:
         "web-typecheck",
         "react-apps-check",
         "web-db-migrations",
+        "app-host-unit-tests",
         "tests",
-        "tests-required-status",
         "tests-build-and-lag",
         "release-ghostty-cli-helper",
         "release-build",
@@ -407,11 +407,11 @@ def test_ci_status_job_accepts_skipped_routed_jobs() -> None:
 
 
 def test_required_tests_status_waits_for_app_host_matrix() -> None:
-    block = workflow_job_block("tests-required-status")
+    block = workflow_job_block("tests")
 
     assert "name: tests" in block
     assert "      - changes" in block
-    assert "      - tests" in block
+    assert "      - app-host-unit-tests" in block
     assert "if: ${{ always() }}" in block
     assert 'macos == "true" and tests["result"] != "success"' in block
     assert 'tests["result"] not in {"success", "skipped"}' in block

tests/test_ci_self_hosted_guard.sh

@@ -711,7 +711,8 @@ check_no_bare_github_hosted_runners() {
   # switch is a single repo-variable flip with no PR. A bare GitHub-hosted
   # label (ubuntu-*, macos-NN) cannot be redirected, so it is forbidden.
   # Bare paid-provider labels (blacksmith-*, warp-*, depot-*) stay allowed for
-  # deliberate single-runner pins such as the testmanagerd-wedged `tests` job.
+  # deliberate single-runner pins such as the testmanagerd-wedged
+  # `app-host-unit-tests` job.
   local hits
   hits="$(grep -rnE "runs-on:[[:space:]]*(ubuntu-[a-z0-9.]+|macos-[a-z0-9]+)[[:space:]]*$" "$ROOT_DIR/.github/workflows" || true)"
   if [[ -n "$hits" ]]; then
@@ -793,7 +794,7 @@ check_no_self_hosted_fleet_runners() {
 # ci.yml jobs
 check_no_bare_github_hosted_runners
 check_no_self_hosted_fleet_runners
-check_macos_runner "$CI_FILE" "tests"
+check_macos_runner "$CI_FILE" "app-host-unit-tests"
 check_macos_runner "$CI_FILE" "tests-build-and-lag"
 check_macos_runner "$CI_FILE" "release-ghostty-cli-helper"
 check_macos_runner "$CI_FILE" "release-build"