ci: stop skipped linux jobs from transitively skipping staged macOS jobs

.github/workflows/ci.yml

@@ -388,7 +388,12 @@ jobs:
     needs:
       - changes
       - linux-preflight
-    if: ${{ needs.changes.outputs.macos == 'true' }}
+    # !cancelled() disables the implicit success() gate, which GitHub evaluates
+    # over the transitive needs chain: linux-preflight runs behind routed linux
+    # jobs that legitimately skip (web/go/agent-session paths), and that
+    # transitive skip otherwise marks every macOS job skipped even when
+    # linux-preflight itself succeeds. Require the direct needs explicitly.
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.linux-preflight.result == 'success' && needs.changes.outputs.macos == 'true' }}
     name: app-host unit tests (${{ matrix.shard }}/4)
     # App-host XCTest needs a runner that can broker testmanagerd control
     # sessions. Validated head-to-head that warp-macos-15-arm64-6x runs the
@@ -772,7 +777,12 @@ jobs:
     needs:
       - changes
       - linux-preflight
-    if: ${{ needs.changes.outputs.macos == 'true' }}
+    # !cancelled() disables the implicit success() gate, which GitHub evaluates
+    # over the transitive needs chain: linux-preflight runs behind routed linux
+    # jobs that legitimately skip (web/go/agent-session paths), and that
+    # transitive skip otherwise marks every macOS job skipped even when
+    # linux-preflight itself succeeds. Require the direct needs explicitly.
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.linux-preflight.result == 'success' && needs.changes.outputs.macos == 'true' }}
     runs-on: ${{ vars.MACOS_RUNNER_15 || 'warp-macos-15-arm64-6x' }}
     timeout-minutes: 40
     env:
@@ -1076,7 +1086,12 @@ jobs:
     needs:
       - changes
       - linux-preflight
-    if: ${{ needs.changes.outputs.macos == 'true' }}
+    # !cancelled() disables the implicit success() gate, which GitHub evaluates
+    # over the transitive needs chain: linux-preflight runs behind routed linux
+    # jobs that legitimately skip (web/go/agent-session paths), and that
+    # transitive skip otherwise marks every macOS job skipped even when
+    # linux-preflight itself succeeds. Require the direct needs explicitly.
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.linux-preflight.result == 'success' && needs.changes.outputs.macos == 'true' }}
     # Build the full cmux scheme once, then run the required display/runtime
     # regressions from the same DerivedData instead of queuing a second display
     # runner for UI-only checks.
@@ -1412,7 +1427,10 @@ jobs:
       - changes
       - linux-preflight
       - swift-package-tests
-    if: ${{ needs.changes.outputs.macos == 'true' }}
+    # See app-host-unit-tests: explicit direct-needs gate instead of the
+    # implicit success() so skipped routed linux jobs upstream of
+    # linux-preflight do not skip this job transitively.
+    if: ${{ !cancelled() && needs.changes.result == 'success' && needs.linux-preflight.result == 'success' && needs.swift-package-tests.result == 'success' && needs.changes.outputs.macos == 'true' }}
     # Compile the same unsigned universal Release app that nightly builds before
     # signing, notarization, and publishing. This catches DEBUG/Release boundary
     # mistakes before they reach main.

tests/test_ci_change_areas.py

@@ -491,6 +491,11 @@ def test_required_tests_status_waits_for_app_host_matrix() -> None:
 
 
 def test_macos_jobs_wait_for_linux_preflight() -> None:
+    # The staged macOS jobs must gate on their direct needs explicitly.
+    # A bare `if: needs.changes.outputs.macos == 'true'` keeps the implicit
+    # success() gate, which GitHub evaluates over the transitive needs chain:
+    # routed linux jobs that legitimately skip (web/go/agent-session paths)
+    # then mark every macOS job skipped even though linux-preflight succeeded.
     for job_name in [
         "app-host-unit-tests",
         "swift-package-tests",
@@ -500,7 +505,16 @@ def test_macos_jobs_wait_for_linux_preflight() -> None:
         block = workflow_job_block(job_name)
         assert "      - changes" in block
         assert "      - linux-preflight" in block
-        assert "if: ${{ needs.changes.outputs.macos == 'true' }}" in block
+        assert "if: ${{ needs.changes.outputs.macos == 'true' }}" not in block
+        expected_needs = ["changes", "linux-preflight"]
+        if job_name == "release-build":
+            expected_needs.append("swift-package-tests")
+        expected_if = (
+            "if: ${{ !cancelled() && "
+            + " && ".join(f"needs.{need}.result == 'success'" for need in expected_needs)
+            + " && needs.changes.outputs.macos == 'true' }}"
+        )
+        assert expected_if in block, f"{job_name} must gate on direct needs explicitly"
 
 
 def test_linux_preflight_blocks_macos_on_cheap_layer_failure() -> None: