[ixuz]

What and why

A change met CI up to four times on its way to the site: its pull request, the merge queue, the push to main, and the release commit. Every run had the same say, and every run ran the slowest jobs again: the timing-dependent ones (pod, contract and the user journeys). In recent runs they took about 30 of each run's 36–41 job-minutes. 4.1.1 stayed released but not deployed until the engines' journeys, flaky on the release commit, had been re-run by hand three times. Its code had already passed in the merge queue and on main.

This makes each stage's job explicit, as the issue proposes (written down in docs/releasing.md#what-each-stage-checks):

• A new gate job (npm run ci:gate, scripts/ciGate.ts) decides what each run runs. Every job that runs blocks.
  • Every job runs in a pull request, in the merge queue, on a run by hand, and on a push to main that no merge_group run passed, such as an advisory's merge through the ruleset bypass. So a release built on such a commit waits for the full run.
  • The timing-dependent jobs are skipped on a push to main that the queue passed, and on a release commit whose parent passed CI on main. These are pod, contract, and the journeys in every browser. The same code already passed them. ci-ok accepts a skipped pod, contract or journeys then, and only then.
• The gate fails a release commit that changes anything besides the files release.config.mjs commits, or that has more than one parent.
• The /journeys/ report keeps every browser. The release commit's run takes the journeys' blobs from the run that ran them on its code, which the gate names (tested-by). That is usually the parent's merge queue run, which now keeps traces and blobs for every journeys job. If those blobs have expired (GitHub keeps them 7 days, so a release made late by hand), the gate runs every job instead, and the deploy is never left stuck.
• The journeys are split into shards: each browser's journeys run in two shards side by side (journeys (chromium, 1/2) to journeys (engines, 2/2)). Pull requests and the queue wait about half as long for them. Each shard repeats about a minute of setup.
• New warm jobs keep main's caches filled. The skipped jobs used to save each server's images, the journeys' server image and the journeys' browsers. warm looks them up, and warm-images and warm-browsers make and save only what is missing. Like caches, they never fail the run.
• Interop skips a release commit, which only changes the version's files. Its run has a concurrency group of its own, so it no longer cancels the Interop run on the code it releases.
• Each job is labeled deterministic or timing-dependent, in ci.yml and in docs/testing.md. docs/testing.md also adds the rule to count requests rather than time them.

The timing-dependent jobs now run twice per merged pull request (in its pull request and in the queue), not four times. A push to main the queue passed now takes about 4 minutes instead of about 9.

Some of this can only be confirmed on GitHub: the run passing with skipped jobs, downloading the journeys' blobs from another run, and the cache lookup. Please watch the first push to main and the first release after merging. On that first push, every journeys job should be skipped and journeys-report should pull all four blobs from the queue run. No repository settings need to change.

Closes: #199

Checklist

• One issue. This pull request addresses one issue, linked above.
• One step. This pull request does not finish its issue, so it says Refs:, not Closes:. Leave this unchecked otherwise.
• Done, as AGENTS.md defines it: npm run check passes (lint, Markdown and spelling included), npm run lint:reuse too if a file was added, and npm run crosscheck too if ns/ or decks/ changed. (npm run lint:workflows passes too; crosscheck n/a: ns/ and decks/ unchanged)
• Tests. New and changed code has its tests, and every package stays at 100% coverage (docs/testing.md).
• Docs. The docs say what changed, and a new page in docs/ is listed in docs/docs.ttl. (no new page)
• Languages. A new or changed message is in every locale: en, sv, ko, de, es and fr (packages/ui/src/i18n/). (n/a: no message changed)
• Vocabulary and shapes. Any change to ns/ was agreed in an issue first; no published ns/shapes/*/vN.ttl or decks/*/vN.ttl was edited; generated files were regenerated, not edited. (n/a: nothing in ns/ or decks/ changed)
• Breaking? Nothing in the public API breaks, or a commit says so (! and a BREAKING CHANGE: footer). npm run check:breaking sees a line of api/ that goes, but not a feature removed, nor a reader that reads less than before.
• Pod data. Any change to what the app writes to a pod comes with its migration (docs/migrations.md). (n/a: the app is unchanged)
• Policy. Any change to an external rule the code follows (SM-2, the plural rules, a specification) is cited. (n/a)
• Licenses. New content is MIT, or a deck states its own license; a new file has its SPDX header (npm run lint:reuse), or a new deck its line in REUSE.toml; third-party content is credited.
• Architecture. Imports follow docs/boundaries.md and the layers of docs/architecture.md.
• Run. I ran the app (npm run dev) and tried the change, and considered the user journeys. (n/a: CI only; the journeys' report on main is covered above)
• Authorship. I read and understand every line of this pull request, and answer for it, whatever tools helped write it (CONTRIBUTING.md).
• Commits. Each commit is one logical change, in Conventional Commits form (type(scope): subject, ! and a BREAKING CHANGE: footer if it breaks something), with an imperative subject and a body that explains why (CONTRIBUTING.md).