ci: split CI into reusable workflows (#7168)

## Why

The monolithic CI workflow is a frequent merge-conflict hotspot.
Splitting cohesive domains into same-repository reusable workflows keeps
one centrally filtered entry point while letting Rust, desktop,
relay/PostgreSQL, client, and security CI evolve independently.

## What

- Keep `ci.yml` as the only push/pull-request orchestrator with
unchanged concurrency and path detection.
- Move 18 execution jobs into five `workflow_call`-only domain workflows
without changing their runners, steps, matrices, caches, artifacts,
permissions, or timeouts.
- Keep the relay artifact producer with desktop integration, the
complete PostgreSQL lane, and relay E2E consumers.
- Preserve all 12 existing required GitHub Actions contexts through
lightweight top-level compatibility gates, so the repository ruleset
does not need to change.
- Update the Rust-cache contract to follow Unit Tests into
`_ci-rust.yml`.

## Risk Assessment

CI-only change with moderate workflow-orchestration risk. The main risks
are reusable-workflow output propagation, skip behavior, and visible
check naming; the old required names remain explicit top-level jobs, and
the draft will stay open until an exact-head GitHub Actions run and
independent review are complete.

Generated with Codex

---------

Signed-off-by: Luke Tornquist <tornquist@squareup.com>
Signed-off-by: tornquist <tornquist@squareup.com>

scripts/test-ci-required-context-isolation.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+orchestrator="$repo_root/.github/workflows/ci.yml"
+desktop_workflow="$repo_root/.github/workflows/_ci-desktop.yml"
+macos_workflow="$repo_root/.github/workflows/_ci-desktop-macos.yml"
+rust_workflow="$repo_root/.github/workflows/_ci-rust.yml"
+relay_workflow="$repo_root/.github/workflows/_ci-relay.yml"
+clients_workflow="$repo_root/.github/workflows/_ci-clients.yml"
+
+fail() {
+  echo "CI required-context isolation contract failed: $*" >&2
+  exit 1
+}
+
+[[ -f "$macos_workflow" ]] || fail "missing _ci-desktop-macos.yml"
+
+extract_job() {
+  local job=$1
+  local workflow=$2
+  awk -v job="$job" '
+    $0 == "  " job ":" { found = 1 }
+    found && $0 ~ /^  [a-zA-Z0-9_-]+:$/ && $0 != "  " job ":" { exit }
+    found { print }
+  ' "$workflow"
+}
+
+desktop_call=$(extract_job desktop-domain "$orchestrator")
+macos_call=$(extract_job desktop-macos-domain "$orchestrator")
+rust_call=$(extract_job rust "$orchestrator")
+rust_cross_compile_call=$(extract_job rust-cross-compile-domain "$orchestrator")
+relay_call=$(extract_job relay-domain "$orchestrator")
+relay_artifacts_call=$(extract_job relay-artifacts-domain "$orchestrator")
+postgres_call=$(extract_job postgres-domain "$orchestrator")
+clients_call=$(extract_job clients "$orchestrator")
+mobile_swift_call=$(extract_job mobile-swift-domain "$orchestrator")
+desktop_gate=$(extract_job desktop "$orchestrator")
+macos_gate=$(extract_job desktop-build-macos "$orchestrator")
+
+[[ "$desktop_call" == *'uses: ./.github/workflows/_ci-desktop.yml'* ]] ||
+  fail "Desktop Domain must call _ci-desktop.yml"
+[[ "$macos_call" == *'uses: ./.github/workflows/_ci-desktop-macos.yml'* ]] ||
+  fail "Desktop macOS domain must call _ci-desktop-macos.yml"
+[[ "$desktop_gate" == *'needs: [changes, desktop-domain]'* ]] ||
+  fail "Desktop required check must depend only on Desktop Domain"
+[[ "$desktop_gate" == *'needs.desktop-domain.outputs.desktop_result'* ]] ||
+  fail "Desktop required check must read the Desktop Domain result"
+[[ "$macos_gate" == *'needs: [changes, desktop-macos-domain]'* ]] ||
+  fail "Desktop Build (macOS) required check must depend only on the macOS domain"
+[[ "$macos_gate" == *'needs.desktop-macos-domain.outputs.desktop_macos_result'* ]] ||
+  fail "Desktop Build (macOS) required check must read the macOS domain result"
+
+[[ "$rust_call" == *'lane: required'* && "$rust_cross_compile_call" == *'lane: cross-compile'* ]] ||
+  fail "required Rust checks and server cross-compiles must use isolated calls"
+[[ "$relay_artifacts_call" == *'lane: artifacts'* && "$relay_call" == *'lane: required'* && "$postgres_call" == *'lane: postgres'* ]] ||
+  fail "relay artifacts, required checks, and PostgreSQL tests must use isolated calls"
+[[ "$relay_call" == *'needs: [changes, relay-artifacts-domain]'* ]] ||
+  fail "required relay checks must wait for the artifact producer"
+[[ "$postgres_call" == *'needs: [changes, relay-artifacts-domain]'* ]] ||
+  fail "PostgreSQL tests must wait for the artifact producer"
+[[ "$clients_call" == *'lane: required'* && "$mobile_swift_call" == *'lane: mobile-swift'* ]] ||
+  fail "required client checks and Mobile Swift must use isolated calls"
+
+grep -Fq "inputs.lane == 'cross-compile'" "$rust_workflow" ||
+  fail "Rust cross-compiles must be selected by their isolated lane"
+grep -Fq "inputs.lane == 'postgres'" "$relay_workflow" ||
+  fail "PostgreSQL tests must be selected by their isolated lane"
+grep -Fq "inputs.lane == 'artifacts'" "$relay_workflow" ||
+  fail "relay artifacts must be selected by their isolated lane"
+grep -Fq "inputs.lane == 'mobile-swift'" "$clients_workflow" ||
+  fail "Mobile Swift must be selected by its isolated lane"
+
+grep -Fq 'on:' "$macos_workflow" || fail "macOS workflow is missing its trigger"
+grep -Fq '  workflow_call:' "$macos_workflow" || fail "macOS workflow must use workflow_call"
+grep -Fq '  desktop-build-macos:' "$macos_workflow" || fail "macOS build job is missing"
+grep -Fq 'desktop_macos_result:' "$macos_workflow" || fail "macOS result output is missing"
+
+if grep -Eq '^  desktop-build-macos:|desktop_macos_result:' "$desktop_workflow"; then
+  fail "Desktop Domain must not own the isolated macOS required check"
+fi
+
+echo "CI required-context isolation contract passed"

scripts/test-rust-cache-contract-regressions.sh

@@ -139,7 +139,7 @@ YAML
 run_contract >/dev/null
 rm -rf "$tmp/.github/actions" "$tmp/.github/workflows/new-cache-user.yaml"
 
-python3 - "$tmp/.github/workflows/ci.yml" <<'PY'
+python3 - "$tmp/.github/workflows/_ci-rust.yml" <<'PY'
 import pathlib
 import sys
 

scripts/test-rust-cache-contract.sh

@@ -91,9 +91,9 @@ cache_uses.each do |path, location, ref|
   end
 end
 
-ci_path = root / ".github" / "workflows" / "ci.yml"
-ci = workflows.fetch(ci_path) { load_workflow.call(ci_path) }
-jobs = ci["jobs"]
+rust_ci_path = root / ".github" / "workflows" / "_ci-rust.yml"
+rust_ci = workflows.fetch(rust_ci_path) { load_workflow.call(rust_ci_path) }
+jobs = rust_ci["jobs"]
 unit_tests = jobs.is_a?(Hash) ? jobs["unit-tests"] : nil
 abort "unit-tests job missing" unless unit_tests.is_a?(Hash)
 steps = unit_tests["steps"]