M0: Tangled CI workflows for the lane checks (ENG-277) #9

Merged demi.dev
targeting main from stoopkidddd/eng-277-m0-tangled-ci-workflows-for-the-lane-checks
Merged opened by and assigned to demi.dev
targeting main from stoopkidddd/eng-277-m0-tangled-ci-workflows-for-the-lane-checks

Linear: https://linear.app/engineereddev/issue/ENG-277

What's in this PR:

  • .tangled/workflows/ has three path-filtered nixery workflows, triggered on push and pull_request to main:
    • ts.yml: check:protocol, check:server, check:web;
    • infra.yml: check:infra, then check:brand (sequential);
    • android.yml: the SDK-free spotlessCheck detekt subset. The full check:android is local-only, because the SDK isn't provisioned on the hosted spindle.
  • scripts/ci/check.sh is a lane wrapper that both mise and CI use, so CI doesn't need mise.
  • scripts/ci/validate-workflows.ts validates workflow keys and is wired into check:infra. It fails on unknown keys.
  • pnpm and Gradle caches, with fallback: true.
  • The CI coverage table in docs/agents/tangled.md is marked "CI (pending first run)" until the lead measures the hosted runs.

Verify (lead):

mise run check:infra → exit 0
git push -o verbose-ci → all three workflows parsed; skipped on the branch push ("didn't match trigger push"), as expected

omp locally: every lane check → exit 0; validator with a deliberate "timeout" key → exit 1. Warm local timings: TS 16.8 s, infra+brand 6.3 s, Android subset 0.8 s.

Still to do in this PR (lead): read the hosted pipeline results, measure durations, check Linux brand-export reproducibility, then push a deliberately failing commit (red), revert it (green), and record everything in tangled.md.

Deviation: the root devDependency gains a pinned YAML parser for the validator; root package.json isn't in Touches.

Commits 0