RR-57: CI diet (fewer redundant jobs per PR)

[michaeljgrimm]

Why

On 2026-10-06 between 19:00 and 21:00Z more than 120 Linux jobs ran at once and the queue p90 wait was about 45 minutes (max 69, longer than the merge queue's 60-minute timeout). Each opf PR runs 11 to 12 jobs and 15% of opf jobs are cancelled after partial work. This PR removes work that repeats a SHA or that nobody needs on every PR push, and keeps the merge queue run and the release train fully covered.

What changes

1. No push-to-main run of OPF CI and Coordinated public packages. The merge queue fast-forwards main to the exact commit its merge_group run tested, so the push run repeated every job on the same SHA. workflow_dispatch stays, and so does the nightly schedule of Coordinated public packages (its main-status job now reports on the nightly run only).
2. Node 22 and Node 26 engines-range legs moved out of OPF CI into .github/workflows/engines-range.yml (same job name, Node 22 (engines range) and Node 26 (engines range)). They run in the merge queue, on workflow_dispatch and on a PR with the label full-ci. A PR runs Verify OPF packages (Linux, Node 24) only.
3. CLI portability, Published packages matrix and Installed parity audit: macOS and Windows legs no longer run on every matching PR (Linux leg only for the two matrices) and the push-to-main run is gone. They run in the merge queue (only when the queue entry changes one of the workflow's paths: paths: is ignored for merge_group, so a first scope job applies it through the new .github/actions/paths-changed action), on the weekly schedule and manual runs, and on a PR with the label full-ci.
4. Installed candidates (windows-latest|macos-latest) already took no Windows or macOS runner on a PR (RR-45). It now also honours full-ci next to ecosystem-full. Because packages is a required aggregator, this workflow does not get the labeled event type: the label takes effect on the next push or a re-run.
5. timeout-minutes on every job (the four missing ones: Verify OPF packages 20, Node N (engines range) 20, npm-publish publish and release 15; CLI portability raised 15 to 25 because Windows p90 is 13.4 min). pnpm check:ci-diet fails when a job has none.
6. Opt-in label full-ci for the legs moved off pull_request. It uses the labeled event type and if: contains(github.event.pull_request.labels.*.name, 'full-ci'), so it works without a re-push. Any other label starts nothing and sits in its own concurrency group, so it cancels nothing. One line in AGENTS.md: add the label when a change touches OS- or Node-version-specific code.

Verification that the queue tested the commit main points to

Not an assumption: for the last six merged PRs (#406, #404, #427, #426, #424, #418) the GraphQL checkSuites of the PR's mergeCommit.oid (main's commit) hold a merge_group run of OPF CI and of Coordinated public packages and a push run of each, all on that one SHA. The push runs are the duplicates removed here. scripts/release-train.mjs commitChecks (used by tag, settle and status) reads commits/<sha>/check-runs plus commit statuses and picks the latest run per name; it never looks at the event. The ruleset 24382980 requires packages, Installed candidates (windows-latest), Installed candidates (macos-latest) and Verify OPF packages, and the merge_group run reports all four on the release commit, so tag still finds them green and settle still waits for pending ones. No change to release-train.mjs is needed.

Caveats stated plainly:

• Anything that reaches main without the queue (an administrator push or a ruleset bypass) now gets no per-commit full run; tag would report not reported for the required checks and stop, and the nightly run is the safety net.
• The strict tracker-staleness failure used to fire on the push run only (OPF_TRACKER_STALE is fail outside PRs and the queue); it now fires only on a manual OPF CI run (the nightly run is Coordinated public packages, which does not run pnpm test). Tracker refresh still runs on every push to main and opens the refresh PR, so a stale tracker is still repaired. Tracker refresh still runs on every push to main.
• Merge-queue runs of workflows that are not required checks (the engines legs, CLI portability, the matrices) do not hold the queue; a failure shows on the merge commit and in release-train as a non-required failing check. Making them required is an owner decision.

Jobs per PR

	before	after
OPF CI	3 (Verify, Node 22, Node 26)	1
Coordinated public packages	8 (3 shards of core, render, pptx-editor, packages, 2 Installed candidates that skip by policy on Ubuntu)	8 (unchanged)
CLI portability (when packages/cli, packages/javascript, skills, package.json or the lockfile change)	2 (Windows, macOS)	0
Total on a typical code PR	11 to 13	9
On merge (the push run after the queue)	11 plus 2 CLI legs when the paths match	0

Estimated runner minutes saved per week

Using the numbers from the CI baseline: engines legs plus the duplicate Verify about 3.0k min/week; CLI macOS and Windows about 4.4k per 14 days (about 2.2k/week); opf macOS about 5.2k raw minutes per 14 days (about 2.6k/week, overlapping the CLI figure and the push-run Installed candidates). So roughly 5.2k min/week from the two disjoint figures and up to about 7.8k counting the macOS figure on top. Cross-check from the other side: a push run after a merge costs about 66 job-minutes at p50 (OPF CI 20.6, Coordinated 45.4) plus about 10 for the CLI portability push runs that match their paths, and opf merged 202 PRs in the last 7 days, so the dropped push runs are on the order of 9k to 15k raw job-minutes a week (about 40% of push runs were cancelled, per ci-cd.md). These are estimates, not billing data; macOS minutes bill at 10x.

Tests

scripts/ci-diet.test.mjs (pnpm check:ci-diet): every job has a timeout, the heavy workflows have merge_group and no push, the moved legs have the labeled type, the full-ci condition and the ignored-label concurrency group, the required workflows never get labeled, and the paths-changed action is run against a real queue-shaped repository (match, no match, other events, unfetchable base: all fail open). scripts/ecosystem-scope.test.mjs is updated for the new trigger set and the full-ci policy. Also run: ecosystem-lock, core-golden, ecosystem-roll, release-train, run-checks tests (84 pass).

Not exercised until the queue runs it: the scope job and the three moved workflows on a real merge_group event. The if: expressions were reviewed by hand and the YAML parses; there is no actionlint in this environment.

Label full-ci created in this repository for the opt-in.

Observed on this PR

All checks green. Running jobs (this PR also edits installed-parity.yml and published-matrix.yml, so their Linux legs ran): Verify OPF packages, ecosystem-render, ecosystem-pptx-editor, ecosystem-core x3, packages, Installed candidates x2 (0.2 min each, policy skip on Ubuntu, so the required names still report), Published matrix (ubuntu-24.04), Installed parity (ubuntu-24.04). Skipped as designed: the Node 22 and 26 legs (engines-range.yml), the scope jobs, cli, both Cross-OS comparison jobs and main-status. A typical code PR (no change to those two matrices) runs 9 jobs.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes when and where required vs optional CI runs relative to merge queue and main, so mis-scoped workflows could miss OS/Node coverage or duplicate gates until check:ci-diet and queue behavior are validated in production.

Overview
RR-57 cuts redundant GitHub Actions work: typical PRs run fewer jobs, while merge-queue, nightly, and opt-in paths keep cross-platform and multi-Node coverage.

Push-to-main is removed from OPF CI, Coordinated public packages, and the path-filtered portability/matrix workflows, because the merge queue already tests the commit that lands on main. Required checks stay on that SHA for release-train.mjs; the ecosystem nightly schedule remains the backstop (and main-status / main-red issues now track schedule failures only).

Heavy legs move off default PR runs: Node 22/26 engines-range jobs leave opf-ci.yml for new engines-range.yml (merge queue, workflow_dispatch, or PR with full-ci). CLI Windows/macOS, published-matrix, and installed-parity drop push triggers, add merge_group plus a scope job using new .github/actions/paths-changed (path globs GitHub ignores on merge_group). PRs without full-ci run Linux-only matrix legs and skip cross-OS compare jobs; labeled + concurrency groups avoid unrelated labels re-firing or cancelling runs. Ecosystem Installed candidates also treats full-ci like ecosystem-full for real OS runners.

Operational guardrails: every workflow job gets timeout-minutes; pnpm check:ci-diet (scripts/ci-diet.test.mjs) locks in triggers, timeouts, full-ci wiring, and paths-changed behavior. Docs (AGENTS.md, ecosystem/release runbooks) and a changelog fragment document the model.

^{Reviewed by Cursor Bugbot for commit 9b03ed6. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: db7e40da-af83-4487-990d-eb0b97097a34)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 66ef45a3-c30c-4216-813a-d740d36d2e91)