CI: PRs build and test only the packages they touch (#1561)

Clippy, the test archive and the test shards cover the packages a PR changes plus their dependents. Main, nightly and manual runs stay full.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

.github/workflows/ci.yml

@@ -1,4 +1,10 @@
 # Fast checks always run; native builds run for code/CI changes.
+# PRs test what they touch; main and nightly test everything. On a pull request the "Select
+# checks" job maps the changed files to workspace packages (scripts/ci/affected.py), adds the
+# packages that depend on them, and Clippy, the test archive and the test shards cover only
+# those. Changes to the lockfile, root manifest, toolchain/cargo/nextest config, .github/,
+# vendor/, tests/, scripts/ or any file no package owns select the whole workspace, as do
+# pushes to main, the nightly run and Run workflow.
 # Tests are built once and run in 4 shards. A few heavy tests (see .config/nextest.toml) are
 # skipped on pull requests and run on pushes to main and nightly.
 # Cross-compilation is opt-in through Run workflow; release builds remain in release.yml.
@@ -49,6 +55,8 @@ jobs:
     outputs:
       native: ${{ steps.paths.outputs.native }}
       kernel: ${{ steps.paths.outputs.kernel }}
+      full: ${{ steps.paths.outputs.full }}
+      packages: ${{ steps.paths.outputs.packages }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -62,6 +70,8 @@ jobs:
         run: |
           native=false
           kernel=false
+          full=true
+          packages=
           if [ "$EVENT_NAME" != pull_request ]; then
             native=true
           else
@@ -76,9 +86,20 @@ jobs:
                 *) native=true ;;
               esac
             done < "$RUNNER_TEMP/ci-paths"
+            # Pull requests build and test the touched packages and their dependents.
+            python3 -I scripts/ci/affected.py --paths "$RUNNER_TEMP/ci-paths" > "$RUNNER_TEMP/ci-affected"
+            cat "$RUNNER_TEMP/ci-affected"
+            full=$(sed -n 's/^full=//p' "$RUNNER_TEMP/ci-affected")
+            packages=$(sed -n 's/^packages=//p' "$RUNNER_TEMP/ci-affected")
+            # Code changed but nothing was selected: be safe and test everything.
+            if [ "$native" = true ] && [ "$full" != true ] && [ -z "$packages" ]; then full=true; fi
           fi
-          echo "native=$native" >> "$GITHUB_OUTPUT"
-          echo "kernel=$kernel" >> "$GITHUB_OUTPUT"
+          {
+            echo "native=$native"
+            echo "kernel=$kernel"
+            echo "full=$full"
+            echo "packages=$packages"
+          } >> "$GITHUB_OUTPUT"
 
   checks:
     name: Format and repository checks
@@ -102,6 +123,8 @@ jobs:
         run: cargo xtask layers
       - name: Web app offline use and updates (headless Chrome)
         run: cargo xtask web-offline-test
+      - name: Affected-package selection self-test
+        run: python3 -I scripts/ci/test_affected.py
 
   clippy:
     name: Native Linux Clippy
@@ -117,7 +140,15 @@ jobs:
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: native-clippy
-      - run: cargo clippy --workspace --all-targets --profile ci --locked -- -D warnings
+      - name: Clippy
+        env:
+          FULL: ${{ needs.changes.outputs.full }}
+          PACKAGES: ${{ needs.changes.outputs.packages }}
+        run: |
+          # Pull requests lint the affected packages (scripts/ci/affected.py); everything else, all.
+          scope=(--workspace)
+          if [ "$FULL" != true ]; then scope=(); for p in $PACKAGES; do scope+=(-p "$p"); done; fi
+          cargo clippy "${scope[@]}" --all-targets --profile ci --locked -- -D warnings
 
   build-tests:
     name: Build tests
@@ -144,7 +175,14 @@ jobs:
         with:
           tool: cargo-nextest
       - name: Compile tests into a nextest archive
-        run: cargo nextest archive --workspace --cargo-profile ci --locked --archive-file tests.tar.zst
+        env:
+          FULL: ${{ needs.changes.outputs.full }}
+          PACKAGES: ${{ needs.changes.outputs.packages }}
+        run: |
+          # Pull requests archive only the affected packages (scripts/ci/affected.py).
+          scope=(--workspace)
+          if [ "$FULL" != true ]; then scope=(); for p in $PACKAGES; do scope+=(-p "$p"); done; fi
+          cargo nextest archive "${scope[@]}" --cargo-profile ci --locked --archive-file tests.tar.zst
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nextest-archive
@@ -183,7 +221,7 @@ jobs:
           # Extract into ./target: tests that run a built binary (env!("CARGO_BIN_EXE_*")) have
           # the build job's path, which is the same checkout path here.
           cargo nextest run --archive-file tests.tar.zst --workspace-remap . --extract-to . --extract-overwrite \
-            --profile ci --partition "slice:$SHARD/4" "${all[@]}"
+            --profile ci --partition "slice:$SHARD/4" --no-tests=pass "${all[@]}"
       - name: Robustness goldens sample (pull requests that touch the kernel)
         # Every 8th seed of tests/robustness/goldens.json, a quarter per shard; pushes to main and
         # the nightly run every seed in the step above.