Cut CI to a lean per-package-manager gate (+ #1353 Gradle Windows cells)

.github/workflows/gradle-compatibility.yml

@@ -42,7 +42,9 @@ name: Gradle patch compatibility
 # the same suites, filters, Gradle lines and JDKs on ubuntu on every PR and
 # in the merge queue. The ubuntu `extras` run on a PR only when it touches
 # Gradle code (`changes` below); every other PR gets them from the nightly
-# (#1177). Windows cells run on every PR that matches `paths:`.
+# (#1177). Windows cells run on every PR that matches `paths:`, except
+# hosted on the middle Gradle lines (7.6.6, 8.14.3), which run nightly: a PR
+# runs hosted on Windows on 6.9.4 and 9.8.0 only (#1300).
 
 on:
   pull_request:
@@ -235,6 +237,16 @@ jobs:
           - os: ${{ github.event_name == 'pull_request' && 'macos-latest' || '' }}
           # ci.yml's `e2e` runs these ubuntu cells on every PR (#1177).
           - os: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || '' }}
+          # Windows hosted on a PR: only the oldest (6.9.4) and newest (9.8.0)
+          # lines. The middle two are ~40 min each, 40% of a PR run's Windows
+          # minutes; they run nightly, and ci.yml's `e2e` runs hosted on all
+          # four lines on ubuntu on every PR (#1300).
+          - os: ${{ github.event_name == 'pull_request' && 'windows-latest' || '' }}
+            gradle: '7.6.6'
+            mode: hosted
+          - os: ${{ github.event_name == 'pull_request' && 'windows-latest' || '' }}
+            gradle: '8.14.3'
+            mode: hosted
     runs-on: ${{ vars.DISABLE_DEPOT_RUNNERS != 'true' && (matrix.os == 'ubuntu-latest' && 'depot-ubuntu-24.04-4' || matrix.os == 'ubuntu-22.04' && 'depot-ubuntu-22.04-4') || matrix.os }}
     timeout-minutes: 60
     steps: &cell-steps

scripts/ci-vlt-proof-suites.py

@@ -39,7 +39,9 @@ def proof_upgrade(vlt, node):
 
 def ci_cells(text=None):
     reader = load_reader()
-    rows = reader.job_rows(reader.jobs(text if text is not None else CI.read_text(encoding="utf-8")), "e2e")
+    # Only rows that run on every pull request: e2e-extended is CI_SCOPE=full only.
+    rows = reader.job_rows(reader.jobs(text if text is not None else CI.read_text(encoding="utf-8")), "e2e",
+                           extended=False)
     return {(r["suite"], r["os"], r["vlt"], r.get("vlt_store_linker", ""), r.get("vlt_upgrade", ""))
             for r in rows if r.get("vlt") and r.get("test_filter") == "--include-ignored vlt_pinned_matrix"}
 

scripts/tests/test_ci_e2e_tiers.py

@@ -329,7 +329,12 @@ def test_upgrade_rule_matches_the_install_step(self):
 
     def test_lv0_mode_migration_without_ci_upgrade_stays(self):
         self.assertIn("mode_migration_vlt", proof.remaining(self.suites, "windows-latest", "1.0.0-rc.14", text=TEXT))
-        self.assertNotIn("mode_migration_vlt", proof.remaining(self.suites, "ubuntu-latest", "1.0.0-rc.14", text=TEXT))
+        # Lean scope: the rc.14 Linux row is in e2e-extended, which pull
+        # requests skip, so the proof keeps it. Only rows of the lean `e2e`
+        # job (here: redirect on vlt 1.2.0) are left out.
+        self.assertIn("mode_migration_vlt", proof.remaining(self.suites, "ubuntu-latest", "1.0.0-rc.14", text=TEXT))
+        self.assertNotIn("e2e_redirect_vlt_build",
+                         proof.remaining(self.suites, "ubuntu-latest", "1.2.0", text=TEXT))
 
 
 if __name__ == "__main__":

scripts/tests/test_ci_scheduling.py

@@ -75,7 +75,9 @@ def test_os_builds_use_the_same_artifact_contract(self):
         for family in ("e2e", "cargo-vex-matrix"):
             self.assertIn("pattern: e2e-bin-${{ matrix.os }}*", "\n".join(JOBS[family]))
         for job in ("e2e-build-macos", "e2e-macos", "cargo-vex-matrix-macos", "yarn-berry-e2e-macos"):
-            self.assertIn("    if: github.event_name != 'pull_request'", JOBS[job])
+            # Never on pull_request; lean scope also skips them (CI_SCOPE).
+            self.assertIn("    if: (github.event_name != 'pull_request') && (vars.CI_SCOPE == 'full'"
+                          " || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')", JOBS[job])
 
     def test_row_reader_preserves_both_os_siblings(self):
         jobs = reader.jobs("""jobs:

scripts/tests/test_ci_vlt_rows.py

@@ -4,6 +4,7 @@
 subset they use (no PyYAML on the runners)."""
 
 import importlib.util
+import json
 import re
 import unittest
 from pathlib import Path
@@ -102,6 +103,11 @@ def jobs(text):
 def matrix_include(job_lines):
     """The `strategy.matrix.include` rows of a job (flow or block style)."""
     lines = [strip_comment(l) for l in job_lines]
+    scoped = next((l for l in job_lines if l.strip().startswith("include: ${{ fromJSON(")), None)
+    if scoped is not None:
+        # CI_SCOPE-switched rows: the first JSON literal is the full table.
+        literal = re.search(r"&& '(\[.*?\])'", scoped).group(1)
+        return [{k: str(v) for k, v in row.items()} for row in json.loads(literal)]
     at = next(i for i, l in enumerate(lines) if l.strip() == "include:")
     base = indent(lines[at])
     rows, current, item_indent = [], None, None
@@ -126,10 +132,13 @@ def matrix_include(job_lines):
     return rows
 
 
-def job_rows(jobs_by_id, job):
-    """All rows of a job family, including its independent OS siblings."""
+def job_rows(jobs_by_id, job, extended=True):
+    """All rows of a job family, including its independent OS siblings.
+
+    `extended=False` leaves out the `-extended` sibling, whose rows run only
+    with CI_SCOPE=full or nightly, not on every pull request."""
     rows = matrix_include(jobs_by_id[job])
-    for os_name in ("windows", "macos"):
+    for os_name in ("windows", "macos") + (("extended",) if extended else ()):
         sibling = f"{job}-{os_name}"
         if sibling in jobs_by_id:
             rows += matrix_include(jobs_by_id[sibling])