From f27ea3a132880ee2aba640329caa542b12cc5e24 Mon Sep 17 00:00:00 2001 From: Wanjohi Date: Sun, 6 Sep 2026 14:05:37 +0300 Subject: [PATCH] ci: run each half only when that half changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both jobs ran on every pull request, so a change to a Rust binary waited on a Postgres service and a full TypeScript test run, and a change to a TypeScript route spent a runner compiling Rust. Neither told anyone anything. A `paths` filter belongs to a workflow rather than to a job, so the two jobs become two workflows. That is the whole cost of the change: both job bodies are carried over unchanged, and only the triggers differ. The filters are written from what each job actually reads. `packages/` is entirely TypeScript so it is taken whole, and the two TypeScript apps are named because the rest of `apps/` is Rust. The Rust job takes its own directory plus the workspace root and lockfile, which pin every version it builds against, and nothing else — it depends on no other member of the workspace. The failure mode of a path filter is silence: a job that does not run leaves a green pull request. So the one thing a future change has to remember is written where it will be read — adding a TypeScript app means adding it to that list. --- .github/workflows/nesdoctor.yml | 48 +++++++++++++++++++++++++ .github/workflows/{ci.yml => web.yml} | 52 +++++++++++++-------------- 2 files changed, 73 insertions(+), 27 deletions(-) create mode 100644 .github/workflows/nesdoctor.yml rename .github/workflows/{ci.yml => web.yml} (52%) diff --git a/.github/workflows/nesdoctor.yml b/.github/workflows/nesdoctor.yml new file mode 100644 index 00000000..0ca8917d --- /dev/null +++ b/.github/workflows/nesdoctor.yml @@ -0,0 +1,48 @@ +# `nesdoctor`, and deliberately nothing else in the Rust workspace. +# +# The rest of the Rust half has never been under CI, so widening this to +# `--workspace` would turn every pull request red for reasons unrelated to the +# pull request. Widen it one member at a time, as each is made to pass — and +# give each one its own `paths` filter when you do. +name: nesdoctor + +on: + push: + branches: [main] + pull_request: + paths: + - "apps/nesdoctor/**" + # The workspace root pins every dependency version and owns the build + # profiles, so a change to either reaches this binary even though nothing + # under `apps/nesdoctor` moved. `Cargo.lock` is the resolved answer to + # the same question. + # + # No other member is listed because `nesdoctor` depends on no other + # member: its dependency tree is part of what it asks to be trusted on, + # and it is four external crates deep. If that ever stops being true, + # the crate it takes belongs here. + - "Cargo.toml" + - "Cargo.lock" + - ".github/workflows/nesdoctor.yml" + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Rust toolchain + run: rustup toolchain install stable --profile minimal --component clippy,rustfmt --no-self-update + - uses: Swatinem/rust-cache@v2 + with: + workspaces: ". -> target" + - name: Format + run: cargo fmt -p nesdoctor -- --check + - name: Clippy + run: cargo clippy -p nesdoctor --all-targets -- -D warnings + - name: Test + run: cargo test -p nesdoctor + # Runs without touching the network, so this stays fast and cannot fail + # on a runner's egress rules. The network path is exercised by the + # release workflow's smoke test, where it belongs. + - name: Runs at all + run: cargo run -p nesdoctor -- --quiet --no-net --no-steam --json "$RUNNER_TEMP/nd.json" < /dev/null diff --git a/.github/workflows/ci.yml b/.github/workflows/web.yml similarity index 52% rename from .github/workflows/ci.yml rename to .github/workflows/web.yml index e32d6493..9937397f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/web.yml @@ -1,12 +1,35 @@ -name: CI +# The TypeScript half: the control-plane apps and the packages they share. +# +# Split from the Rust half rather than being two jobs in one workflow, because +# a job cannot carry its own `paths` filter — only a workflow can. Two files is +# what "run this only when its own code changes" costs, and the alternative +# spends a runner on every pull request deciding it has nothing to do. +name: web on: push: branches: [main] pull_request: + paths: + # Every TypeScript workspace member. `packages/` is entirely TypeScript + # so it is taken whole; `apps/` is mostly Rust, so its two members are + # named. **Adding a TypeScript app means adding it here** — nothing + # detects that on its own, and the failure is silent: the tests do not + # run and the pull request goes green. + - "apps/api/**" + - "apps/auth/**" + - "packages/**" + # The workspace itself. A lockfile change reaches every member, and the + # linter and compiler settings decide whether any of it passes. + - "package.json" + - "bun.lock" + - "tsconfig.json" + - "oxlintrc.json" + # This file. A change to how the tests run is a change worth running. + - ".github/workflows/web.yml" jobs: - web: + test: runs-on: ubuntu-latest services: postgres: @@ -42,28 +65,3 @@ jobs: run: bun test env: TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5432/nestri - - # Scoped to `nesdoctor` deliberately. The rest of the Rust half has never - # been under CI, so widening this to `--workspace` would turn every PR red - # for reasons unrelated to the PR. Widen it one member at a time, as each is - # made to pass. - nesdoctor: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Rust toolchain - run: rustup toolchain install stable --profile minimal --component clippy,rustfmt --no-self-update - - uses: Swatinem/rust-cache@v2 - with: - workspaces: ". -> target" - - name: Format - run: cargo fmt -p nesdoctor -- --check - - name: Clippy - run: cargo clippy -p nesdoctor --all-targets -- -D warnings - - name: Test - run: cargo test -p nesdoctor - # Runs without touching the network, so this stays fast and cannot fail - # on a runner's egress rules. The network path is exercised by the - # release workflow's smoke test, where it belongs. - - name: Runs at all - run: cargo run -p nesdoctor -- --quiet --no-net --no-steam --json "$RUNNER_TEMP/nd.json" < /dev/null