ci(test): consolidate backend coverage job (#1830)

Author: JSONbored

.github/workflows/ci.yml

@@ -105,24 +105,17 @@ jobs:
       - name: Typecheck
         run: npm run typecheck
 
-  # Unit/integration suite + coverage, sharded across parallel runners to cut the
-  # critical-path wall-clock. Each shard publishes its PARTIAL lcov as a build
-  # artifact; the `coverage-upload` job merges all 3 and uploads to Codecov ONCE,
-  # so Codecov computes codecov/patch a single time on the complete report instead
-  # of flapping FAILURE->SUCCESS as each shard's partial upload arrived. vitest's
-  # local 90% backstop is disabled here (COVERAGE_NO_THRESHOLDS) because a single
-  # shard only exercises part of the tree; the backstop still runs on the full
-  # local `npm run test:coverage`.
+  # Unit/integration suite + coverage. This used to fan out into 3 GitHub matrix
+  # jobs because hosted-runner minutes were the bottleneck. On the self-hosted
+  # runner, the extra checkout/install/artifact fan-in surface has become more
+  # expensive and fragile than the saved wall-clock, so keep coverage in one job
+  # and let Vitest use the runner's local worker concurrency.
   test:
     name: test
     needs: changes
     if: ${{ github.event_name == 'push' || needs.changes.outputs.backend == 'true' }}
     runs-on: ${{ fromJSON((github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true) && '["ubuntu-latest"]' || '["self-hosted","gittensory"]') }}
     timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3]
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -148,104 +141,35 @@ jobs:
           exit 1
       - name: Prepare test reports dir
         run: mkdir -p reports/junit
-      - name: Test with coverage (shard ${{ matrix.shard }}/3)
+      - name: Test with coverage
         id: coverage
         env:
-          COVERAGE_NO_THRESHOLDS: "1"
-          VITEST_JUNIT_PATH: reports/junit/vitest-shard-${{ matrix.shard }}.xml
-        run: npm run test:coverage -- --shard=${{ matrix.shard }}/3
+          VITEST_JUNIT_PATH: reports/junit/vitest.xml
+        run: npm run test:coverage -- --maxWorkers=100%
       - name: Test failure guidance
         if: ${{ failure() && steps.coverage.conclusion == 'failure' }}
         run: |
-          echo "::error title=Tests::A test in shard ${{ matrix.shard }}/3 failed."
-          echo "Coverage itself is gated by Codecov on changed lines (codecov/patch), computed from the merged shards."
-          echo "Reproduce locally with the full suite: 'npm run test:coverage' (no sharding)."
-      - name: Upload partial coverage artifact (shard ${{ matrix.shard }}/3)
-        # A passing shard writes coverage/lcov.info; a FAILING shard writes none
-        # (vitest coverage.reportOnFailure defaults to false). Gate on success() so a
-        # red shard skips this (and fails the job → fails `validate`), and use
-        # if-no-files-found:error so a green shard always ships exactly one lcov and
-        # the merge job can assert all 3 arrived. The single Codecov upload happens
-        # in the coverage-upload job below.
+          echo "::error title=Tests::The backend test coverage suite failed."
+          echo "Coverage itself is gated by Codecov on changed lines (codecov/patch), computed from the complete lcov generated by this job."
+          echo "Reproduce locally with: 'npm run test:coverage'."
+      - name: Upload coverage to Codecov
         if: ${{ success() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: coverage-lcov-shard-${{ matrix.shard }}
-          path: ./coverage/lcov.info
-          if-no-files-found: error
-          retention-days: 1
-      - name: Upload Vitest results to Codecov
-        if: ${{ !cancelled() }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./reports/junit/vitest-shard-${{ matrix.shard }}.xml
-          report_type: test_results
+          files: ./coverage/lcov.info
           disable_search: true
           override_branch: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref_name }}
           override_commit: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
           override_pr: ${{ github.event_name == 'pull_request' && github.event.pull_request.number || '' }}
           fail_ci_if_error: false
-
-  # Merge the 3 shard lcovs into one complete report and upload to Codecov ONCE.
-  # The shards no longer upload coverage directly: that made Codecov score
-  # codecov/patch on a partially-merged subset of shards as each upload arrived, so
-  # the status flapped FAILURE->SUCCESS until all 3 landed. A single upload of the
-  # merged report means Codecov computes patch exactly once on complete data. This
-  # job inherits `test`'s path filter and only runs when ALL shards passed, so a
-  # non-backend PR (which skips `test`) emits no codecov/patch context at all — and
-  # codecov/patch is intentionally NOT a required branch-protection context, so an
-  # absent status never strands the review gate at pending.
-  coverage-upload:
-    name: coverage-upload
-    needs: [changes, test]
-    if: ${{ (github.event_name == 'push' || needs.changes.outputs.backend == 'true') && needs.test.result == 'success' }}
-    runs-on: ${{ fromJSON((github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true) && '["ubuntu-latest"]' || '["self-hosted","gittensory"]') }}
-    timeout-minutes: 10
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          # Full history so Codecov can resolve the merge base for patch coverage.
-          fetch-depth: 0
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-      - name: Download shard coverage artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: coverage-lcov-shard-*
-          path: shard-coverage
-      - name: Collect the shard lcovs into stable paths
-        # download-artifact nests each artifact under its own directory, and
-        # upload-artifact's internal layout for a single file is version-dependent, so
-        # find the lcovs wherever they landed and copy them to fixed names for an
-        # explicit Codecov upload. Assert exactly 3 — fewer means an upload/runner
-        # anomaly (needs.test.result already gated this job to all-shards-green), and a
-        # hard CI failure (one-shot auto-close, recoverable) beats silently scoring
-        # codecov/patch on a subset.
-        run: |
-          mkdir -p merged-lcov
-          n=0
-          for f in $(find shard-coverage -name lcov.info | sort); do
-            n=$((n + 1))
-            cp "$f" "merged-lcov/shard-${n}.info"
-          done
-          echo "Collected ${n} shard lcov file(s)."
-          if [ "${n}" -ne 3 ]; then
-            echo "::error title=Coverage::Expected 3 shard lcov files, found ${n}."
-            exit 1
-          fi
-      - name: Upload all shard coverage to Codecov in one report
-        # All 3 partial lcovs in a SINGLE codecov-action invocation = ONE upload;
-        # Codecov merges them server-side before computing codecov/patch (it "always
-        # merges report data" and holds notifications until merge completes), so the
-        # status is computed once on the complete report — eliminating the partial
-        # flap that 3 separate per-shard uploads caused. fail_ci_if_error stays false
-        # so a Codecov outage cannot fail CI / auto-close an honest PR (codecov/patch
-        # is simply absent, which the gate treats as not-a-FAILURE).
+      - name: Upload Vitest results to Codecov
+        if: ${{ !cancelled() }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./merged-lcov/shard-1.info,./merged-lcov/shard-2.info,./merged-lcov/shard-3.info
+          files: ./reports/junit/vitest.xml
+          report_type: test_results
           disable_search: true
           override_branch: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref_name }}
           override_commit: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
@@ -406,7 +330,7 @@ jobs:
   # Path-filtered jobs report "skipped", which is treated as success.
   validate:
     name: validate
-    needs: [changes, lint, test, coverage-upload, workers, mcp, rees, ui, security]
+    needs: [changes, lint, test, workers, mcp, rees, ui, security]
     if: ${{ always() }}
     runs-on: ${{ fromJSON((github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true) && '["ubuntu-latest"]' || '["self-hosted","gittensory"]') }}
     timeout-minutes: 2

test/unit/workflow-runner-labels.test.ts

@@ -9,7 +9,7 @@ describe("workflow runner labels", () => {
     const trustedRunnerExpression =
       '${{ fromJSON((github.event_name == \'pull_request\' && github.event.pull_request.head.repo.fork == true) && \'["ubuntu-latest"]\' || \'["self-hosted","gittensory"]\') }}';
 
-    expect(workflow.match(new RegExp(escapeRegExp(trustedRunnerExpression), "g")) ?? []).toHaveLength(10);
+    expect(workflow.match(new RegExp(escapeRegExp(trustedRunnerExpression), "g")) ?? []).toHaveLength(9);
     expect(workflow).not.toContain("|| 'self-hosted'");
     expect(workflow).not.toContain('"fork-ci"');
   });