Pre-push gate, Linux-only VRT, CI path filters

.github/workflows/build.yml

@@ -17,16 +17,67 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Path filter is the `paths` job, not `on.pull_request.paths`.
+# A workflow skipped by a trigger path filter leaves the required check
+# `Check NextJS Build` Pending. A job skipped by `if` reports Success.
+# An unrelated pull request sets run=false and skips the build on purpose.
+# A failed or cancelled path filter must not skip it: the job runs and exits 1.
+# Push, merge_group, and workflow_dispatch always build.
 jobs:
+  paths:
+    name: Path filter
+    runs-on: ubuntu-latest
+    outputs:
+      run: ${{ steps.filter.outputs.run }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Match build paths
+        id: filter
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT_NAME" != "pull_request" ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+            echo "build paths match: true (not a pull request)"
+            exit 0
+          fi
+          git diff --name-only "$BASE_SHA" HEAD > "$RUNNER_TEMP/changed.txt"
+          run=false
+          while IFS= read -r file; do
+            [ -n "$file" ] || continue
+            case "$file" in
+              src/*|public/*|vendor/*|*.css|package.json|package-lock.json|next.config.ts|next.config.test.ts|postcss.config.mjs|tsconfig*.json|scripts/locks-sdk-smoke.mjs|scripts/paykit-wasm-smoke.mjs|scripts/ci-launch-e2e.sh|.github/workflows/build.yml)
+                run=true
+                break
+                ;;
+            esac
+          done < "$RUNNER_TEMP/changed.txt"
+          echo "run=$run" >> "$GITHUB_OUTPUT"
+          echo "build paths match: $run"
+
   build:
     name: Check NextJS Build
+    needs: paths
+    if: always() && (needs.paths.result != 'success' || needs.paths.outputs.run == 'true')
     runs-on: ubuntu-latest
     # Last-10 median was 47 min because paykit-wasm-smoke held the event loop
     # after "passed". Post-fix remainder is install (~40s) + next build (~3 min)
     # + server smoke (~2s) ≈ 5 min; 10 min is 2× that, not 2× the hang.
     timeout-minutes: 10
 
     steps:
+      - name: Fail closed when the path filter did not succeed
+        if: needs.paths.result != 'success'
+        run: |
+          echo "Path filter result is ${{ needs.paths.result }}. Check NextJS Build fails closed."
+          exit 1
+
       - name: Checkout code
         uses: actions/checkout@v4
 
@@ -39,6 +90,15 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Cache Next.js build
+        uses: actions/cache@v4
+        with:
+          path: .next/cache
+          key: nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('src/**') }}
+          restore-keys: |
+            nextjs-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
+            nextjs-${{ runner.os }}-
+
       - name: Smoke test vendored Locks SDK
         run: node scripts/locks-sdk-smoke.mjs
 
@@ -107,7 +167,7 @@ jobs:
   launch-e2e:
     name: launch-e2e
     needs: build
-    if: github.event_name == 'pull_request' && startsWith(github.base_ref, 'release/shop-')
+    if: always() && needs.build.result == 'success' && github.event_name == 'pull_request' && startsWith(github.base_ref, 'release/shop-')
     runs-on: ubuntu-latest
     container:
       image: mcr.microsoft.com/playwright:v1.60.0-noble

.github/workflows/vrt-marketplace.yml

@@ -9,21 +9,68 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Path filter is the `paths` job, not `on.pull_request.paths`.
+# A workflow skipped by a trigger path filter leaves the required check
+# `vrt-marketplace` Pending. A job skipped by `if` reports Success.
+# An unrelated pull request sets run=false and skips the job on purpose.
+# A failed or cancelled path filter must not skip it: the job runs and exits 1.
+# Patterns: src/**, public/** (rendered assets such as /images/*),
+# **/*.css, postcss.config.mjs, package-lock.json, vitest.config.ts,
+# plus this workflow and the VRT scripts it runs.
 jobs:
+  paths:
+    name: Path filter
+    runs-on: ubuntu-latest
+    outputs:
+      run: ${{ steps.filter.outputs.run }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Match VRT paths
+        id: filter
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          git diff --name-only "$BASE_SHA" HEAD > "$RUNNER_TEMP/changed.txt"
+          run=false
+          while IFS= read -r file; do
+            [ -n "$file" ] || continue
+            case "$file" in
+              src/*|public/*|*.css|postcss.config.mjs|package-lock.json|vitest.config.ts|.github/workflows/vrt-marketplace.yml|scripts/ci-vrt-marketplace.sh|scripts/vrt-linux.sh|scripts/vrt-related.mjs|scripts/vrt-revert-outside.sh)
+                run=true
+                break
+                ;;
+            esac
+          done < "$RUNNER_TEMP/changed.txt"
+          echo "run=$run" >> "$GITHUB_OUTPUT"
+          echo "vrt paths match: $run"
+
   vrt-marketplace:
     name: vrt-marketplace
+    needs: paths
+    if: always() && (needs.paths.result != 'success' || needs.paths.outputs.run == 'true')
     runs-on: ubuntu-latest
     # Same image as local Linux proof (`package-lock.json` playwright 1.60.0).
     container:
       image: mcr.microsoft.com/playwright:v1.60.0-noble
-      options: --user 1001
+      options: --user 1001 --shm-size=2g
     # Non-container HEAD median 4m0s (run 35590590935). Containerized
     # 9fb822a01 cancelled at 8m with tests still running (run 35593190722:
     # ~1.5m setup, ~3m cold vite optimize, tests unfinished). Missing
     # baselines run compare then --update. 25 min covers that second suite.
     timeout-minutes: 25
 
     steps:
+      - name: Fail closed when the path filter did not succeed
+        if: needs.paths.result != 'success'
+        run: |
+          echo "Path filter result is ${{ needs.paths.result }}. vrt-marketplace fails closed."
+          exit 1
+
       - name: Checkout code
         uses: actions/checkout@v4