ci(scope): narrow #494 invariant — changed tests join windows lane, not full matrix

full_matrix fired on 15/15 sampled PRs because any tests/** change forced it,
costing ~25 runner-minutes each. A changed test file now always joins the
scoped windows lane (covering the #482 OS-specific failure class per-file)
and still runs on ubuntu 22/24 via targeted_tests; the residual macOS /
windows-node-22 cross-product is covered on every push to next.

Also narrows WINDOWS_HINTS from 6 substrings (102/633 files, a ~10-minute
scoped lane) to windows/win32/shell/path — the dropped hints (workflow,
install, hook) are either platform-independent lint tests or already covered
by fullMatrix rules.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/ci-test-scope.cjs

@@ -169,11 +169,11 @@ const RULES = [
       path.includes('prompt-injection-scan') ||
       path.startsWith('tests/fixtures/adversarial/security/'),
     tests: [
-      'tests/secret-scan-lint.test.cjs',
-      'tests/prompt-injection-scan.test.cjs',
-      'tests/security-prompt-injection.test.cjs',
-      'tests/read-injection-scanner.test.cjs',
-      'tests/security-scan.test.cjs',
+      'tests/secret-scan-lint.security.test.cjs',
+      'tests/prompt-injection-scan.security.test.cjs',
+      'tests/security-prompt-injection.security.test.cjs',
+      'tests/read-injection-scanner.security.test.cjs',
+      'tests/security-scan.security.test.cjs',
     ],
   },
   {
@@ -308,7 +308,13 @@ function addAll(set, values) {
   for (const value of values) set.add(value);
 }
 
-const WINDOWS_HINTS = ['windows', 'path', 'shell', 'workflow', 'install', 'hook'];
+// Windows-sensitive filename hints — deliberately narrow. 'workflow',
+// 'install', and 'hook' were dropped from this list: workflow-lint tests are
+// platform-independent YAML/policy checks, and the installer/hooks RULES set
+// fullMatrix=true, so the full Windows lane already runs when those paths
+// change. The old six-hint list pulled 102 of ~633 test files into the scoped
+// windows lane, turning it into a ~10-minute job on every PR.
+const WINDOWS_HINTS = ['windows', 'win32', 'shell', 'path'];
 const isWindowsHint = s => WINDOWS_HINTS.some(k => s.toLowerCase().includes(k));
 
 function classify(files) {
@@ -343,10 +349,15 @@ function classify(files) {
 
     if (file.startsWith('tests/') && file.endsWith('.test.cjs')) {
       targeted.add(file);
-      fullMatrix = true;
-      if (isWindowsHint(file)) {
-        windows.add(file);
-      }
+      // #494 invariant, narrowed: a changed test must still be exercised on
+      // the divergent OS before merge, but at per-file cost — it ALWAYS joins
+      // the scoped windows lane instead of triggering the three full parity
+      // lanes. (full_matrix fired on 15/15 sampled PRs because test-driven
+      // PRs always touch tests/, costing ~25 runner-minutes each.) Changed
+      // tests already run on ubuntu-22 and ubuntu-24 via targeted_tests; the
+      // residual macOS / windows-node-22 cross-product is covered by the full
+      // matrix on every push to next.
+      windows.add(file);
     }
 
     for (const rule of RULES) {

scripts/run-cross-platform-tests.cjs

@@ -1,67 +0,0 @@
-'use strict';
-
-const { spawnSync } = require('child_process');
-const { ExitError, runMain } = require('./lib/cli-exit.cjs');
-
-const CROSS_PLATFORM_TEST_REASON = Object.freeze({
-  PASS: 'pass',
-  TEST_FAILURE: 'test_failure',
-  INFRA_FAILURE: 'infra_failure',
-  UNKNOWN_FAILURE: 'unknown_failure',
-});
-
-function classify(exitCode, output) {
-  if (exitCode === 0) return CROSS_PLATFORM_TEST_REASON.PASS;
-  if (exitCode === 2 || /infrastructure failure|worktree\.Construct/i.test(output)) {
-    return CROSS_PLATFORM_TEST_REASON.INFRA_FAILURE;
-  }
-  if (/\bFAIL\b|\d+\s+failures?\)/i.test(output)) {
-    return CROSS_PLATFORM_TEST_REASON.TEST_FAILURE;
-  }
-  return CROSS_PLATFORM_TEST_REASON.UNKNOWN_FAILURE;
-}
-
-function runCrossPlatformTests(options = {}, deps = {}) {
-  const {
-    base = 'next',
-    head = 'HEAD',
-    source = '.',
-    targets = 'linux,macos',
-    cwd = process.cwd(),
-  } = options;
-  const runner = deps.spawnSync || spawnSync;
-
-  const args = ['--targets', targets, '--base', base, '--head', head, '--source', source];
-  const result = runner('gsd-test', args, { cwd, encoding: 'utf8' });
-
-  const stdout = result.stdout || '';
-  const stderr = result.stderr || '';
-  const output = `${stdout}\n${stderr}`;
-  const exitCode = Number(result.status ?? 1);
-  const reason = classify(exitCode, output);
-
-  return {
-    ok: exitCode === 0,
-    reason,
-    exitCode,
-    command: ['gsd-test', ...args].join(' '),
-    stdout,
-    stderr,
-  };
-}
-
-if (require.main === module) {
-  function main() {
-    const result = runCrossPlatformTests();
-    const line = `[cross-platform-tests] reason=${result.reason} exit=${result.exitCode}`;
-    if (result.ok) {
-      process.stdout.write(`${line}\n`);
-      return 0;
-    }
-    process.stderr.write(`${line}\n`);
-    throw new ExitError(result.exitCode);
-  }
-  runMain(main);
-}
-
-module.exports = { CROSS_PLATFORM_TEST_REASON, runCrossPlatformTests };

tests/ci-test-scope.test.cjs

@@ -279,18 +279,36 @@ describe('ci-test-scope.cjs', () => {
   });
 });
 
-describe('ci-test-scope superset invariant (#494)', () => {
-  // Facet A: any tests/** change → full_matrix === true
-  test('A1: a specific changed test file forces full_matrix', () => {
+describe('ci-test-scope superset invariant (#494, narrowed)', () => {
+  // Facet A (narrowed): a changed test file no longer triggers the full
+  // parity matrix — instead it must ALWAYS run on the scoped windows lane,
+  // so OS-specific breakage in the changed test (the #482 class) is still
+  // exercised pre-merge. Ubuntu 22/24 coverage comes via targeted_tests.
+  test('A1: a changed test file joins the windows scoped lane without full_matrix', () => {
     const result = scopeFor(['tests/bug-1974-context-exhaustion-record.test.cjs']);
-    assert.strictEqual(result.full_matrix, true,
-      `expected full_matrix=true for tests/** change, got: ${JSON.stringify(result)}`);
+    assert.strictEqual(result.full_matrix, false,
+      `expected full_matrix=false for a tests/**-only change, got: ${JSON.stringify(result)}`);
+    assert.ok(result.targeted_tests.includes('tests/bug-1974-context-exhaustion-record.test.cjs'),
+      `expected the changed test in targeted_tests, got: ${JSON.stringify(result.targeted_tests)}`);
+    assert.ok(result.windows_tests.includes('tests/bug-1974-context-exhaustion-record.test.cjs'),
+      `expected the changed test in windows_tests, got: ${JSON.stringify(result.windows_tests)}`);
   });
 
-  test('A2: any tests/** path forces full_matrix', () => {
+  test('A2: a changed test file with no windows hint still joins the windows lane', () => {
+    // commands.test.cjs matches none of the WINDOWS_HINTS substrings — the
+    // unconditional changed-test → windows lane rule must include it anyway.
+    const result = scopeFor(['tests/commands.test.cjs']);
+    assert.strictEqual(result.full_matrix, false);
+    assert.ok(result.windows_tests.includes('tests/commands.test.cjs'),
+      `expected hint-less changed test in windows_tests, got: ${JSON.stringify(result.windows_tests)}`);
+  });
+
+  test('A3: a deleted/nonexistent test path falls back to the unit token, no full_matrix', () => {
     const result = scopeFor(['tests/some-new.test.cjs']);
-    assert.strictEqual(result.full_matrix, true,
-      `expected full_matrix=true for tests/** change, got: ${JSON.stringify(result)}`);
+    assert.strictEqual(result.full_matrix, false);
+    // The nonexistent file is filtered by existingTests(); with nothing left,
+    // the #408 fallback applies so the targeted lane still runs something.
+    assert.deepStrictEqual(result.targeted_tests, ['unit']);
   });
 
   // Facet B: commands/**, agents/** → code_changed AND docs-parity selected

tests/run-cross-platform-tests.test.cjs

@@ -1,46 +0,0 @@
-const { test, describe } = require('node:test');
-const assert = require('node:assert/strict');
-
-const { CROSS_PLATFORM_TEST_REASON, runCrossPlatformTests } = require('../scripts/run-cross-platform-tests.cjs');
-
-describe('run cross-platform tests module', () => {
-  test('returns pass reason on zero exit', () => {
-    const out = runCrossPlatformTests({}, {
-      spawnSync: () => ({ status: 0, stdout: 'ok', stderr: '' }),
-    });
-    assert.strictEqual(out.ok, true);
-    assert.strictEqual(out.reason, CROSS_PLATFORM_TEST_REASON.PASS);
-    assert.ok(out.command.includes('--base next'));
-  });
-
-  test('classifies infrastructure failure', () => {
-    const out = runCrossPlatformTests({}, {
-      spawnSync: () => ({ status: 2, stdout: '', stderr: 'infrastructure failure' }),
-    });
-    assert.strictEqual(out.ok, false);
-    assert.strictEqual(out.reason, CROSS_PLATFORM_TEST_REASON.INFRA_FAILURE);
-  });
-
-  test('classifies test failure from FAIL marker', () => {
-    const out = runCrossPlatformTests({}, {
-      spawnSync: () => ({ status: 1, stdout: 'linux FAIL 1/2 tests (1 failures)', stderr: '' }),
-    });
-    assert.strictEqual(out.ok, false);
-    assert.strictEqual(out.reason, CROSS_PLATFORM_TEST_REASON.TEST_FAILURE);
-  });
-
-  test('passes options through to command args', () => {
-    let cmd = null;
-    let args = null;
-    runCrossPlatformTests({ base: 'main', head: 'abc123', source: '/tmp/x', targets: 'linux' }, {
-      spawnSync: (c, a) => {
-        cmd = c;
-        args = a;
-        return { status: 0, stdout: '', stderr: '' };
-      },
-    });
-
-    assert.strictEqual(cmd, 'gsd-test');
-    assert.deepStrictEqual(args, ['--targets', 'linux', '--base', 'main', '--head', 'abc123', '--source', '/tmp/x']);
-  });
-});