Linear: https://linear.app/engineereddev/issue/ENG-277
What's in this PR:
.tangled/workflows/has three path-filterednixeryworkflows, triggered on push and pull_request to main:ts.yml: check:protocol, check:server, check:web;infra.yml: check:infra, then check:brand (sequential);android.yml: the SDK-freespotlessCheck detektsubset. The full check:android is local-only, because the SDK isn't provisioned on the hosted spindle.
scripts/ci/check.shis a lane wrapper that both mise and CI use, so CI doesn't need mise.scripts/ci/validate-workflows.tsvalidates workflow keys and is wired into check:infra. It fails on unknown keys.- pnpm and Gradle caches, with
fallback: true. - The CI coverage table in
docs/agents/tangled.mdis marked "CI (pending first run)" until the lead measures the hosted runs.
Verify (lead):
mise run check:infra → exit 0
git push -o verbose-ci → all three workflows parsed; skipped on the branch push ("didn't match trigger push"), as expected
omp locally: every lane check → exit 0; validator with a deliberate "timeout" key → exit 1. Warm local timings: TS 16.8 s, infra+brand 6.3 s, Android subset 0.8 s.
Still to do in this PR (lead): read the hosted pipeline results, measure durations, check Linux brand-export reproducibility, then push a deliberately failing commit (red), revert it (green), and record everything in tangled.md.
Deviation: the root devDependency gains a pinned YAML parser for the validator; root package.json isn't in Touches.