test-files.yml: run chosen test files on their full-test runners, dispatched and read over REST by pnpm ci:test-files

[thejackshelton]

Item 3 of the cloud migration plan (docs/goals/milestone-2-proof/notes/cloud-migration.md): a CI path that runs chosen test files on the right runner, for cloud sessions that have neither a Mac nor the native toolchains.

What changed

• .github/workflows/test-files.yml (workflow_dispatch: ref, files, floor_write, optional nonce). The run-name is test files of <ref>, followed by (<nonce>) when a nonce is given.
  • resolve job:
    • Sorts the files with this workflow's own scripts/test-shards.ts group-files, read against the requested tree, so a branch that predates the mode can still be tested.
    • Also runs the ref's own test-shards.ts all and fails if any requested file's group differs. full-test.yml at that ref would run the file in that other group.
    • An unknown file fails the run before any test starts.
    • Uploads test-files-request: request.json with the ref, the resolved sha, the nonce, and the files with their groups.
  • Group jobs: chrome (macos-26), native (ubuntu-24.04-arm, Swift 6.4.0 + kotlinc 2.4.20 + JDK 17) and platform-free (ubuntu-latest). Each one copies full-test.yml's workflow env, job env, runner, timeout, setup steps, vitest command and "No native run was blocked" scan. Only the source of the file list and the report's name differ, plus DRAGON_FLOOR_WRITE/DRAGON_PIN_WRITE, which are empty unless floor_write is set. full-test.yml has no composite action, and it is left untouched.
    • test-shards.test.ts enforces this. Each of these edits fails it: an extra job env var, a changed DRAGON_WPT_DIR, an extra workflow env var, a disabled blocked grep, if: false on the blocked step, --passWithNoTests -t smoke in the vitest command, -t in the vitest list command, or a dropped step in the native job.
  • "Every requested file ran": checked in each job and again in a summary job over all the reports. It fails if:
    • a requested file is missing from the vitest JSON or appears twice;
    • a file's passed-plus-failed count differs from what an unfiltered vitest list collects for it. vitest reports tests dropped by a -t filter as skipped, and vitest list leaves out statically skipped tests, so this catches filtering;
    • every test in a file was skipped;
    • the report holds a file nobody requested.
  • floor_write: tests run with DRAGON_FLOOR_WRITE=1 and DRAGON_PIN_WRITE=1. Each job uploads test-files-floor-<group>/floor.patch, covering the merge=dragon-floor files in .gitattributes.
  • Concurrency: per job, grouped by ref plus a hash of the files plus the group, with cancel-in-progress: false. Workflow-level concurrency can't compute a hash.
• scripts/test-shards.ts group-files [--root <dir>] <file>...: prints file<TAB>group. It refuses anything that is not exactly a test file of the tree.
• pnpm ci:test-files <ref> <file>... [--floor-write] [--from <branch>] [--once], and --run <id> [--once] (scripts/ci-test-files.ts).
  • Uses REST calls only: gh api for the dispatch (with return_run_details) and the artifact list, gh run view, gh run list, gh run download.
  • Each dispatch carries a random nonce. If the dispatch doesn't return a run id, the fallback matches the exact run-name with that nonce and the dispatching branch, with no time window.
  • Verdict: prints the workflow branch and sha, the ref and the sha it resolved to, and the files with their groups. In dispatch mode it refuses a run whose request has a different ref, nonce or file set (exit 2).
  • The script repeats the "every requested file ran in full" check on the downloaded reports and lists, and prints every failing test.
  • Exit codes: 0 passed, 1 failed, 2 usage error, gh error, cancelled run (nothing judged) or wrong run, 3 pending (--once, or past the wait limit).

No tolerance, check, test or fixture was changed or removed.

What passed (head 7e7f8fe)

• pnpm typecheck.
• Targeted vitest: test-shards, ci-test-files (new), land-devices-ci, chrome-ports, both registry-claims and macroscope-ignore. 7 files, 81 tests passed.
• Pass, dispatched from this branch against itself: grid-computed.test.ts (chrome, launches Chrome) and native-backends.test.ts (native, 11 tests, Swift 6.4 + kotlinc 2.4.20). https://github.com/compiled-run/dragoncss/actions/runs/37737473447, exit 0.
• Pass in dispatch-and-wait mode, with the nonce and request checked live: chrome-ports.test.ts and units.test.ts. https://github.com/compiled-run/dragoncss/actions/runs/37737676305, exit 0.
• The rest ran on throwaway branches, dispatched from them so their checks stay off this PR. Both branches are now deleted.
  • Planted failure: the chrome job and the summary failed, and the client printed the failing test. https://github.com/compiled-run/dragoncss/actions/runs/37737477632, exit 1.
  • floor_write (with will-change dropped from seams-floor.json): seams.test.ts passed, and the downloaded patch restores will-change. https://github.com/compiled-run/dragoncss/actions/runs/37737483094, exit 0.
  • Unknown file: refused in resolve. https://github.com/compiled-run/dragoncss/actions/runs/37737487418, exit 1.
  • Group mismatch: the ref's own test-shards.ts puts grid-computed in native. Resolve failed with "this workflow's test-shards.ts puts it in chrome, but ci-test-files-mismatch's own puts it in native". https://github.com/compiled-run/dragoncss/actions/runs/37737491636, exit 1.
• The full pnpm test and pnpm regen were not run. The change touches no generator input or compiler code.

Notes:

• GitHub returns 404 for a dispatch by file name until the workflow path is registered. While test-files.yml is not on master, I registered the path once with a throwaway branch, since deleted. After landing it is registered for good.
• GitHub files a run's checks under the head of the branch it was dispatched from. An earlier proof dispatched from this branch left failing test-files checks on the old head 7413904.

🤖 Generated with Claude Code