fix(ci): select runtime suites from PR changes only (#7843)

A documentation-only update to #7809 selected desktop builds and E2E tests because path detection compared an old PR base SHA with GitHub's newer synthetic merge commit. The [failing run's path-detection log](https://github.com/block/buzz/actions/runs/35789957773/job/106955810630) includes four unrelated desktop files from `main`; `VISION_MOBILE.md` did not match a runtime filter. Use GitHub's PR file list for pull requests so unrelated changes in the synthetic merge commit cannot select runtime suites. The existing directory filters are unchanged: root and docs/ Markdown do not select runtime suites, while Markdown under runtime directories still selects its affected suites. Mixed code/documentation changes retain normal coverage. Always-on security, policy, and source-contract checks and full push-to-main coverage are unchanged. Added regression coverage runs the pinned paths-filter action against real fixture repositories, including a synthetic merge containing unrelated upstream desktop code. All 35 selection scenarios and 26 required-check scenarios pass; the new regressions failed before the fix. Existing required-context isolation, file-size policy, and security-review contract checks pass, as do script lint and workflow syntax validation. Full workflow lint reports the same two pre-existing shell-quoting findings in the untouched dead-token guard. A desktop E2E build was run to diagnose the unrelated required smoke failure. Related: #7809 (incident, unchanged) and #5756 (shared-input path coverage, separate scope). No matching issue found. PRs with at least 3,000 changed files now select every runtime suite, avoiding GitHub's PR-file-list ceiling. Boundary tests cover 2,999, 3,000, and 3,001 files, including a runtime file omitted beyond the API cap; disabling the safeguard makes the latter two regressions fail. Required checks now run and fail when path selection fails, is cancelled, or is skipped. Regression coverage exercises the workflow conditions and shell checks for all 13 required wrappers, plus an API-denial case against the pinned action. Mutating either the scheduling guard or the result check makes all 13 failure regressions fail. The required mention-settings smoke test expected a pin after explicitly disabling automatic mentions. Waiting for its old avatar to exit reproduced the CI failure 3/3; the test now checks that subsequent mentions remain manual and retains outgoing recipient-tag assertions. Corrected browser regression: 20/20 repeated runs; related picker unit tests: 18/18. No desktop production behavior changed. The always() requirement is now pinned in required-wrapper regression tests; deleting it fails all 26 gate cases. --------- Signed-off-by: Tom Brow <tomb@block.xyz>
2026-10-27 04:30:52 +00:00 · 2026-09-25 16:19:32 -07:00
parent a1fb6645d9
commit 02c6309f53
5 changed files with 411 additions and 57 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,11 +22,11 @@ jobs:
      contents: read
      pull-requests: read
    outputs:
-      rust: ${{ steps.filter.outputs.rust }}
-      desktop: ${{ steps.filter.outputs.desktop }}
-      desktop-rust: ${{ steps.filter.outputs.desktop-rust }}
-      web: ${{ steps.filter.outputs.web }}
-      mobile: ${{ steps.filter.outputs.mobile }}
+      rust: ${{ steps.selection.outputs.rust }}
+      desktop: ${{ steps.selection.outputs.desktop }}
+      desktop-rust: ${{ steps.selection.outputs.desktop-rust }}
+      web: ${{ steps.selection.outputs.web }}
+      mobile: ${{ steps.selection.outputs.mobile }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
@@ -35,7 +35,11 @@ jobs:
      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: filter
        with:
-          token: ''
+          # PR files come from GitHub's PR diff. A tokenless comparison uses the
+          # checked-out merge commit and can include newer, unrelated base changes.
+          token: ${{ github.token }}
+          # Root and docs/ Markdown do not select runtime suites. Markdown under
+          # runtime directories remains covered by the directory filters below.
          filters: |
            rust:
              - 'crates/**'
@@ -84,8 +88,13 @@ jobs:
              - '.github/workflows/mobile-release-candidate.yml'
              - '.github/workflows/ci.yml'
              - '.github/workflows/_ci-*.yml'
+      - name: Select runtime suites conservatively at the PR file-list limit
+        id: selection
+        env:
+          FILTER_OUTPUTS: ${{ toJSON(steps.filter.outputs) }}
+        run: node scripts/ci-runtime-selection.mjs
      - name: Validate PostgreSQL test discovery
-        if: github.event_name == 'push' || steps.filter.outputs.rust == 'true'
+        if: github.event_name == 'push' || steps.selection.outputs.rust == 'true'
        run: |
          scripts/test-postgres-test-discovery.sh
          scripts/test-postgres-test-wrapper.sh
@@ -116,7 +125,7 @@ jobs:
      - name: CI required-context isolation contract
        run: scripts/test-ci-required-context-isolation.sh
      - name: CI path selection regression tests
-        run: node --test scripts/ci-selection.test.mjs
+        run: node --test scripts/ci-selection.test.mjs scripts/ci-required-gates.test.mjs
      - name: File size policy
        run: just file-size-check

@@ -244,7 +253,7 @@ jobs:

  rust-lint:
    name: Rust Lint
-    if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true')
+    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true')))
    needs: [changes, rust]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -252,12 +261,13 @@ jobs:
    steps:
      - name: Check Rust Lint result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.rust.outputs.rust_lint_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  unit-tests:
    name: Unit Tests
-    if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true')
+    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.rust == 'true')))
    needs: [changes, rust]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -265,12 +275,13 @@ jobs:
    steps:
      - name: Check Unit Tests result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.rust.outputs.unit_tests_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  windows-rust:
    name: Windows Rust (x86_64-pc-windows-msvc)
-    if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true')
+    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true')))
    needs: [changes, rust]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -278,12 +289,13 @@ jobs:
    steps:
      - name: Check Windows Rust result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.rust.outputs.windows_rust_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  desktop:
    name: Desktop
-    if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true')
+    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true')))
    needs: [changes, desktop-domain]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -291,12 +303,13 @@ jobs:
    steps:
      - name: Check Desktop result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.desktop-domain.outputs.desktop_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  desktop-build-macos:
    name: Desktop Build (macOS)
-    if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true')
+    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true')))
    needs: [changes, desktop-macos-domain]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -304,12 +317,13 @@ jobs:
    steps:
      - name: Check Desktop Build (macOS) result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.desktop-macos-domain.outputs.desktop_macos_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  desktop-e2e-relay:
    name: Desktop E2E Relay
-    if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true')
+    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true')))
    needs: [changes, relay-artifacts-domain]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -317,12 +331,13 @@ jobs:
    steps:
      - name: Check Desktop E2E Relay result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.relay-artifacts-domain.outputs.desktop_e2e_relay_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  desktop-e2e-integration:
    name: Desktop E2E Integration
-    if: always() && needs.changes.result == 'success' && needs.relay-artifacts-domain.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true')
+    if: always() && (needs.changes.result != 'success' || (needs.relay-artifacts-domain.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true')))
    needs: [changes, relay-artifacts-domain, relay-domain]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -330,12 +345,13 @@ jobs:
    steps:
      - name: Check Desktop E2E Integration result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.relay-domain.outputs.desktop_e2e_integration_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  backend-integration:
    name: Backend Integration (relay e2e)
-    if: always() && needs.changes.result == 'success' && needs.relay-artifacts-domain.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true')
+    if: always() && (needs.changes.result != 'success' || (needs.relay-artifacts-domain.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true')))
    needs: [changes, relay-artifacts-domain, relay-domain]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -343,12 +359,13 @@ jobs:
    steps:
      - name: Check Backend Integration result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.relay-domain.outputs.backend_integration_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  postgres-tests:
    name: PostgreSQL Tests
-    if: always() && needs.changes.result == 'success' && needs.relay-artifacts-domain.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true')
+    if: always() && (needs.changes.result != 'success' || (needs.relay-artifacts-domain.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true')))
    needs: [changes, relay-artifacts-domain, postgres-domain]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -356,12 +373,13 @@ jobs:
    steps:
      - name: Check PostgreSQL Tests result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.postgres-domain.outputs.postgres_tests_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  relay-e2e:
    name: Relay E2E
-    if: always() && needs.changes.result == 'success' && needs.relay-artifacts-domain.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true')
+    if: always() && (needs.changes.result != 'success' || (needs.relay-artifacts-domain.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true')))
    needs: [changes, relay-artifacts-domain, relay-domain]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -369,12 +387,13 @@ jobs:
    steps:
      - name: Check Relay E2E result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.relay-domain.outputs.relay_e2e_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  web:
    name: Web
-    if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.web == 'true')
+    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.web == 'true')))
    needs: [changes, clients]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -382,12 +401,13 @@ jobs:
    steps:
      - name: Check Web result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.clients.outputs.web_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  mobile:
    name: Mobile
-    if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.mobile == 'true')
+    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.mobile == 'true')))
    needs: [changes, clients]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -395,12 +415,13 @@ jobs:
    steps:
      - name: Check Mobile result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.clients.outputs.mobile_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success

  security:
    name: Security
-    if: always() && needs.changes.result == 'success' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true')
+    if: always() && (needs.changes.result != 'success' || ((github.event_name == 'push' || needs.changes.outputs.rust == 'true')))
    needs: [changes, security-domain]
    runs-on: ubuntu-latest
    timeout-minutes: 5
@@ -408,5 +429,6 @@ jobs:
    steps:
      - name: Check Security result
        env:
+          SELECTION_RESULT: ${{ needs.changes.result }}
          RESULT: ${{ needs.security-domain.outputs.security_result }}
-        run: test "$RESULT" = success
+        run: test "$SELECTION_RESULT" = success && test "$RESULT" = success
--- a/desktop/tests/e2e/persistent-agent-audience.spec.ts
+++ b/desktop/tests/e2e/persistent-agent-audience.spec.ts
@@ -601,15 +601,23 @@ test("the mention button opens settings and can undo an address", async ({
  await expect(
    composer.getByRole("button", { name: "Mention someone" }),
  ).toBeVisible();
-  await input.fill("");
+  await expect(
+    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
+  ).toHaveCount(0);
+  // Clear through editor transactions before selecting a manual mention.
+  await input.press("ControlOrMeta+A");
+  await input.press("Backspace");
+  await expect(input).toHaveText("");

  await menu
    .getByRole("button", { name: "Mention Morgarita", exact: true })
    .click();
  await expect(input).toHaveText("@Morgarita ");
+  // Explicitly opting out keeps subsequent mentions manual. The old avatar's
+  // exit animation must not be mistaken for a newly pinned recipient.
  await expect(
    composer.getByTestId(`composer-address-lock-${AGENT_A}`),
-  ).toBeVisible();
+  ).toHaveCount(0);

  await input.type("later");
  await input.press("Enter");
--- a/scripts/ci-required-gates.test.mjs
+++ b/scripts/ci-required-gates.test.mjs
@@ -0,0 +1,90 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { test } from "node:test";
+import { runInNewContext } from "node:vm";
+
+const workflow = readFileSync(
+  new URL("../.github/workflows/ci.yml", import.meta.url),
+  "utf8",
+);
+const gates = [
+  "rust-lint",
+  "unit-tests",
+  "windows-rust",
+  "desktop",
+  "desktop-build-macos",
+  "desktop-e2e-relay",
+  "desktop-e2e-integration",
+  "backend-integration",
+  "postgres-tests",
+  "relay-e2e",
+  "web",
+  "mobile",
+  "security",
+];
+for (const gate of gates) {
+  const body = workflow.match(
+    new RegExp(`^  ${gate}:\\n([\\s\\S]*?)(?=^  [\\w-]+:|$(?![\\s\\S]))`, "m"),
+  )[1];
+  const condition = body.match(/^ {4}if: (.+)$/m)[1];
+  const command = body.match(/^ {8}run: (.+)$/m)[1];
+  function shouldRun(
+    selection,
+    selected = false,
+    event = "pull_request",
+    artifacts = "skipped",
+  ) {
+    // These workflow conditions use only booleans, string equality and grouping.
+    // Evaluate the actual expression after substituting its GitHub context values.
+    assert.match(
+      condition,
+      /\balways\(\)/,
+      "Required wrapper must override GitHub implicit success()",
+    );
+    const expression = condition
+      .replace(/always\(\)/g, "true")
+      .replace(
+        /github\.event_name|needs\.[\w-]+\.(?:result|outputs\.[\w-]+)/g,
+        (key) => {
+          if (key === "github.event_name") return JSON.stringify(event);
+          if (key === "needs.changes.result") return JSON.stringify(selection);
+          if (key === "needs.relay-artifacts-domain.result")
+            return JSON.stringify(artifacts);
+          assert.match(key, /^needs\.changes\.outputs\./);
+          return JSON.stringify(selected ? "true" : "false");
+        },
+      );
+    return runInNewContext(expression, {}, { timeout: 100 });
+  }
+  function check(selection, result) {
+    assert.match(body, /SELECTION_RESULT: \$\{\{ needs.changes.result \}\}/);
+    assert.match(body, /RESULT: \$\{\{ needs\.[\w-]+\.outputs\.[\w_]+ \}\}/);
+    return spawnSync("bash", ["-c", command], {
+      env: { ...process.env, SELECTION_RESULT: selection, RESULT: result },
+      timeout: 1000,
+    }).status;
+  }
+  test(`${gate}: selector failures run and fail the required check`, () => {
+    for (const selection of ["failure", "cancelled", "skipped"]) {
+      for (const artifacts of ["skipped", "success"]) {
+        assert.equal(
+          shouldRun(selection, false, "pull_request", artifacts),
+          true,
+        );
+      }
+      for (const result of ["", "skipped", "success"]) {
+        assert.notEqual(check(selection, result), 0);
+      }
+    }
+  });
+  test(`${gate}: successful selection preserves path gating and suite results`, () => {
+    assert.equal(shouldRun("success"), false);
+    assert.equal(shouldRun("success", true, "pull_request", "success"), true);
+    assert.equal(shouldRun("success", false, "push", "success"), true);
+    assert.equal(check("success", "success"), 0);
+    for (const result of ["", "failure", "cancelled", "skipped"]) {
+      assert.notEqual(check("success", result), 0);
+    }
+  });
+}
--- a/scripts/ci-runtime-selection.mjs
+++ b/scripts/ci-runtime-selection.mjs
@@ -0,0 +1,26 @@
+import assert from "node:assert/strict";
+import { appendFileSync, readFileSync } from "node:fs";
+
+const filters = JSON.parse(process.env.FILTER_OUTPUTS);
+let runAll = false;
+if (process.env.GITHUB_EVENT_NAME === "pull_request") {
+  const event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, "utf8"));
+  const count = event.pull_request.changed_files;
+  assert.ok(
+    Number.isSafeInteger(count) && count >= 0,
+    "Invalid PR changed_files",
+  );
+  // GitHub's PR-files endpoint returns at most 3,000 files. Never use a
+  // potentially incomplete list to skip a runtime suite.
+  runAll = count >= 3000;
+}
+for (const key of ["rust", "desktop", "desktop-rust", "web", "mobile"]) {
+  assert.ok(
+    ["true", "false"].includes(filters[key]),
+    `Invalid ${key} selection`,
+  );
+  appendFileSync(
+    process.env.GITHUB_OUTPUT,
+    `${key}=${runAll ? "true" : filters[key]}\n`,
+  );
+}
--- a/scripts/ci-selection.test.mjs
+++ b/scripts/ci-selection.test.mjs
@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { execFileSync, spawnSync } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import {
  existsSync,
  mkdtempSync,
@@ -8,9 +8,11 @@ import {
  rmSync,
  writeFileSync,
 } from "node:fs";
+import { createServer } from "node:http";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { after, test } from "node:test";
+import { promisify } from "node:util";

 const workflow = readFileSync(
  new URL("../.github/workflows/ci.yml", import.meta.url),
@@ -44,7 +46,7 @@ assert.ok(
  actionPath && existsSync(actionPath),
  `Set PATHS_FILTER_ACTION to the local dist/index.js from dorny/paths-filter@${actionSha}`,
 );
-function select(paths) {
+async function select(paths, pullRequest = false, apiStatus = 200) {
  const repo = mkdtempSync(join(scratch, "repo-"));
  const git = (...args) =>
    execFileSync("git", args, { cwd: repo, stdio: "pipe", timeout: 10000 });
@@ -71,31 +73,139 @@ function select(paths) {
    writeFileSync(join(repo, path), "fixture\n");
  }
  git("add", ".");
+  let server;
+  let apiUrl;
+  const eventPath = join(scratch, `event-${repo.split("/").pop()}.json`);
+  if (pullRequest) {
+    const commit = (message) =>
+      git(
+        "-c",
+        "user.name=CI fixture",
+        "-c",
+        "user.email=ci@example.com",
+        "-c",
+        "commit.gpgsign=false",
+        "commit",
+        "-qm",
+        message,
+        "-s",
+      );
+    const base = git("rev-parse", "HEAD").toString().trim();
+    commit("PR documentation or code");
+    const head = git("rev-parse", "HEAD").toString().trim();
+    git("checkout", "-qb", "upstream", base);
+    const upstreamPath = "desktop/src/upstream-only.ts";
+    mkdirSync(dirname(join(repo, upstreamPath)), { recursive: true });
+    writeFileSync(join(repo, upstreamPath), "upstream change\n");
+    git("add", upstreamPath);
+    commit("Unrelated upstream desktop change");
+    git(
+      "-c",
+      "user.name=CI fixture",
+      "-c",
+      "user.email=ci@example.com",
+      "-c",
+      "commit.gpgsign=false",
+      "merge",
+      "--no-ff",
+      "-m",
+      "Synthetic merge",
+      head,
+    );
+    git("checkout", "--detach");
+    writeFileSync(
+      eventPath,
+      JSON.stringify({
+        pull_request: {
+          number: 7809,
+          changed_files: paths.length,
+          base: { sha: base },
+          head: { sha: head },
+        },
+        repository: { default_branch: "main" },
+      }),
+    );
+    // Serve the PR file list, which intentionally excludes the newer base's code.
+    server = createServer((request, response) => {
+      assert.equal(
+        request.url,
+        "/repos/block/buzz/pulls/7809/files?per_page=100",
+      );
+      response.setHeader("Content-Type", "application/json");
+      if (apiStatus !== 200) {
+        response.writeHead(apiStatus);
+        response.end(JSON.stringify({ message: "Fixture access denied" }));
+        return;
+      }
+      response.end(
+        JSON.stringify(
+          paths
+            .slice(0, 3000)
+            .map((filename) => ({ filename, status: "added" })),
+        ),
+      );
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    apiUrl = `http://127.0.0.1:${server.address().port}`;
+  }
  const output = join(repo, "action-output");
  writeFileSync(output, "");
-  const child = spawnSync(process.execPath, [actionPath], {
-    cwd: repo,
-    encoding: "utf8",
-    timeout: 30000,
-    env: {
-      ...process.env,
-      INPUT_BASE: "HEAD",
-      INPUT_FILTERS: filters,
-      INPUT_TOKEN: "",
-      INPUT_REF: "",
-      GITHUB_OUTPUT: output,
-      "INPUT_PREDICATE-QUANTIFIER":
-        workflow.match(/predicate-quantifier: ['"]?([\w-]+)/)?.[1] ?? "some",
-    },
-  });
-  assert.equal(child.status, 0, child.stdout + child.stderr);
-  return Object.fromEntries(
+  try {
+    await promisify(execFile)(process.execPath, [actionPath], {
+      cwd: repo,
+      encoding: "utf8",
+      timeout: 30000,
+      env: {
+        ...process.env,
+        INPUT_BASE: pullRequest ? "" : "HEAD",
+        INPUT_FILTERS: filters,
+        // Resolve the workflow's token expression to a fixture token. Removing
+        // it must reproduce the contaminated git comparison in the PR fixture.
+        INPUT_TOKEN:
+          pullRequest && /token: \$\{\{ github\.token \}\}/.test(workflow)
+            ? "fixture-token"
+            : "",
+        INPUT_REF: "",
+        GITHUB_EVENT_NAME: pullRequest ? "pull_request" : "",
+        GITHUB_EVENT_PATH: pullRequest ? eventPath : "",
+        GITHUB_REPOSITORY: "block/buzz",
+        GITHUB_API_URL: apiUrl || "https://api.github.com",
+        GITHUB_OUTPUT: output,
+        "INPUT_PREDICATE-QUANTIFIER":
+          workflow.match(/predicate-quantifier: ['"]?([\w-]+)/)?.[1] ?? "some",
+      },
+    });
+  } finally {
+    if (server) await new Promise((resolve) => server.close(resolve));
+  }
+  const rawOutputs = Object.fromEntries(
    [
      ...readFileSync(output, "utf8").matchAll(
        /^(rust|desktop|desktop-rust|web|mobile)<<([^\n]+)\n(true|false)\n\2/gm,
      ),
    ].map(([, key, , value]) => [key, value]),
  );
+  const selectedOutput = join(repo, "selected-output");
+  await promisify(execFile)(
+    process.execPath,
+    [new URL("./ci-runtime-selection.mjs", import.meta.url).pathname],
+    {
+      env: {
+        ...process.env,
+        FILTER_OUTPUTS: JSON.stringify(rawOutputs),
+        GITHUB_EVENT_NAME: pullRequest ? "pull_request" : "push",
+        GITHUB_EVENT_PATH: eventPath,
+        GITHUB_OUTPUT: selectedOutput,
+      },
+      timeout: 10000,
+    },
+  );
+  return Object.fromEntries(
+    readFileSync(selectedOutput, "utf8")
+      .trim()
+      .split("\n")
+      .map((line) => line.split("=")),
+  );
 }
 const scenarios = [
  [
@@ -127,10 +237,47 @@ const scenarios = [
  ],
  ["web", ["web/src/main.tsx"], ["web"]],
  ["documentation", ["README.md"], []],
+  [
+    "incident documentation",
+    ["CONTEXT.md", "docs/mobile-push-suppression.md", "VISION_MOBILE.md"],
+    [],
+  ],
+  [
+    "nested docs directory",
+    ["docs/mobile/design.md", "docs/nips/NIP-FI.md"],
+    [],
+  ],
+  ["crate Markdown", ["crates/buzz-cli/README.md"], ["rust"]],
+  ["desktop Markdown", ["desktop/README.md"], ["desktop"]],
+  [
+    "Tauri Markdown",
+    ["desktop/src-tauri/README.md"],
+    ["desktop", "desktop-rust"],
+  ],
+  ["web Markdown", ["web/docs/design.md"], ["web"]],
+  ["mobile Markdown", ["mobile/test/README.md"], ["mobile"]],
+  ["schema Markdown", ["schema/README.md"], ["rust"]],
+  ["migration Markdown", ["migrations/README.md"], ["rust"]],
+  [
+    "mixed documentation and desktop",
+    ["VISION_MOBILE.md", "docs/mobile/design.md", "desktop/src/main.tsx"],
+    ["desktop"],
+  ],
+  [
+    "mixed documentation and relay",
+    ["docs/desktop/design.md", "crates/buzz-relay/src/lib.rs"],
+    ["rust"],
+  ],
+  ["embedded ACP prompt", ["crates/buzz-acp/src/base_prompt.md"], ["rust"]],
+  [
+    "embedded Tauri skill",
+    ["desktop/src-tauri/src/managed_agents/nest_skill.md"],
+    ["desktop", "desktop-rust"],
+  ],
 ];
 for (const [name, paths, expected] of scenarios) {
-  test(`real paths-filter: ${name}`, () => {
-    const outputs = select(paths);
+  test(`real paths-filter: ${name}`, async () => {
+    const outputs = await select(paths);
    assert.equal(Object.keys(outputs).length, 5);
    assert.deepEqual(
      Object.keys(outputs)
@@ -140,3 +287,64 @@ for (const [name, paths, expected] of scenarios) {
    );
  });
 }
+
+for (const [name, paths, expected] of [
+  [
+    "docs-only",
+    ["CONTEXT.md", "docs/mobile-push-suppression.md", "VISION_MOBILE.md"],
+    [],
+  ],
+  [
+    "mixed mobile and Markdown",
+    ["VISION_MOBILE.md", "mobile/lib/main.dart"],
+    ["mobile"],
+  ],
+  [
+    "mixed desktop and Markdown",
+    ["CONTEXT.md", "desktop/src/main.tsx"],
+    ["desktop"],
+  ],
+]) {
+  test(`PR file list ignores newer base changes: ${name}`, async () => {
+    const outputs = await select(paths, true);
+    assert.equal(Object.keys(outputs).length, 5);
+    assert.deepEqual(
+      Object.keys(outputs)
+        .filter((key) => outputs[key] === "true")
+        .sort(),
+      expected.sort(),
+    );
+  });
+}
+
+test("workflow consumes guarded selection outputs", () => {
+  const outputs = workflow.match(/ {4}outputs:\n([\s\S]*?) {4}steps:/)[1];
+  for (const key of ["rust", "desktop", "desktop-rust", "web", "mobile"]) {
+    assert.ok(outputs.includes(`steps.selection.outputs.${key}`));
+  }
+  assert.match(
+    workflow,
+    /id: selection\n {8}env:\n {10}FILTER_OUTPUTS: \$\{\{ toJSON\(steps.filter.outputs\) \}\}\n {8}run: node scripts\/ci-runtime-selection.mjs/,
+  );
+});
+for (const count of [2999, 3000, 3001]) {
+  test(`PR file-list ceiling: ${count} changed files`, async () => {
+    const paths = Array.from(
+      { length: Math.min(count, 3000) },
+      (_, i) => `docs/file-${i}.md`,
+    );
+    if (count > 3000) paths.push("desktop/src/omitted-by-api.ts");
+    const outputs = await select(paths, true);
+    for (const value of Object.values(outputs)) {
+      assert.equal(value, count >= 3000 ? "true" : "false");
+    }
+  });
+}
+
+test("PR API denial fails path selection instead of reporting no changes", async () => {
+  await assert.rejects(select(["README.md"], true, 403), (error) => {
+    assert.equal(error.code, 1);
+    assert.match(error.stdout + error.stderr, /Fixture access denied/);
+    return true;
+  });
+});