Run compatibility matrices on PRs only for their own files

[Mikola Lysenko (mikolalysenko)]

Fixes #1198

Problem

Ten non-gating compatibility workflows listed shared engine globs in their pull_request.paths: vendor/**, patch/**, vex/**, scan/**, Cargo.lock, and crates/** for npm and pnpm. The workflows are sbt, PDM, vlt, Bun, Composer, npm, Poetry, Go, pnpm and Pipenv. Because of those globs, they started on 59–85% of PR pushes. The profiler (#1198) measured the cost at about 82,000 Linux + 26,000 Windows job-min/day, with 0 PR failures in 24h (371 success / 33 cancelled / 63 skipped). Each one repeats the per-ecosystem blocking slice that ci.yml already runs on every PR, and the breaks they catch show up on push to main. I re-checked the last 12h before this change: sbt, PDM, vlt, Bun and Composer each ran about 120–150 PR runs, with 1 failure among them.

Change

• In each *-compatibility.yml, the pull_request.paths filter now lists only that ecosystem's own files:
  • the workflow file and its scripts, docs and Dockerfiles
  • its tests/*<eco>* files and fixtures
  • source files or directories named after the ecosystem (crates/*/src/**/*<eco>*, plus vendor/jvm/** for sbt and vendor/pypi*.rs for the Python tools)
• PDM and vlt keep ci.yml in their filter, because their capstone skips the cells that ci.yml runs.
• push: main still runs every matrix:
  • It was already unfiltered for sbt, Composer, npm, Go, pnpm and Pipenv.
  • vlt's push filter already equals its old PR filter.
  • PDM, Bun and Poetry had a narrower path-filtered push trigger. It now also includes every path their PR filter drops.
• scripts/tests/test_ci_vlt_rows.py: vendor/**, Cargo.lock and rust-toolchain.toml are now asserted in vlt's push filter only.
• Not touched: gradle-compatibility.yml (CI perf: Gradle patch compatibility — PR runs repeat ci.yml's Gradle e2e tier and run nightly-only extras (~17,000 Linux job-min/day) #1177; open PR Cut release-test wait time and recover Maven downloads #1166 changes that file), ci.yml, ci-ok, clippy.

Expected saving

I replayed the last 297 merged commits on main through the old and new PR filters (glob matcher in the same style as GitHub's paths). This is the share of PRs that trigger each workflow:

workflow	old	new	issue job-min/day (Linux / Windows)	saved (Linux / Windows)
sbt / Mill / scala-cli	86%	5%	28,500 / 3,400	~26,800 / ~3,200
PDM	64%	31%	13,200 / –	~6,800
vlt	89%	16%	10,500 / 9,800	~8,600 / ~8,000
Bun	73%	10%	8,300 / 9,800	~7,200 / ~8,500
Composer	77%	10%	8,000 / 3,200	~7,000 / ~2,800
npm	87%	22%	5,000	~3,700
Poetry	55%	22%	2,600	~1,600
Go	48%	8%	2,400	~2,000
pnpm	88%	11%	2,100	~1,800
Pipenv	50%	23%	1,800	~1,000
total				~66,000 Linux + ~22,000 Windows job-min/day

There is no macOS change: these workflows' macOS legs already left PRs in #1093. There is no direct PR critical-path change either, since none of these workflows is required. Roughly 250 fewer Linux jobs per PR push should cut Linux queue wait for ci.yml.

Measured result

• This PR edits all ten workflow files, so all ten still run on this PR. Its own CI run cannot show the saving.
• The proof is the replay above: on the same 297 commits, PR trigger rates fall from 48–89% to 5–31%.
• The replay also checked coverage. For PDM, vlt, Bun and Poetry (the workflows with a push path filter), 0 of the commits that triggered the old PR filter miss the new push filter. The other six run on every push to main.
• This PR's run on 9da4dfd was all green: CI and ci-ok passed in 33.6 min, and 409 check runs succeeded with 15 skipped. The ten compatibility workflows ran here because the PR edits their files. Together they cost 373 Linux + 101 Windows job-min, from sbt 141 L + 12 W down to Go 10 L. On main, that full set ran on 48–89% of PRs. After this change, a PR that touches only shared engine code skips all of it. A PR that touches only ecosystem files runs just its own workflow.
• The profiler will measure the real per-day drop on PRs opened after this merges.

Where each moved run still runs

• Every PR and merge group: ci.yml's per-ecosystem blocking slice (e2e rows, coverage-docker), unchanged.
• PRs touching the ecosystem's own files: that workflow's full matrix, as before.
• Shared-engine PRs: the full matrix runs on push to main after merge (~40 runs/day per workflow), and on demand via workflow_dispatch on the PR branch.
• vlt: also keeps its nightly run.

Risk

• An engine change that breaks a non-blocking full-matrix cell will be found on push to main instead of on the PR. That is already where every compatibility break in the profiler's window was found: 7 red push runs, all with green PR runs.
• No required check changes: ci-ok and clippy are untouched.

Validation

• actionlint and zizmor --offline on the 10 changed workflows: same findings as origin/main, nothing new.
• python3 -m unittest discover -s scripts/tests: 280 tests OK.
• Bugbot found that the sbt filter missed coursier_cache.rs, ivy_cache.rs and patch/sidecars/coursier.rs. Fixed in 9da4dfd.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ws89aDVJwaF9MUUgy1JLWB

---

Note

Medium Risk
Shared-engine-only PRs may miss full non-blocking compatibility matrices until merge to main; per-ecosystem coverage on every PR still comes from ci.yml.

Overview
Narrows pull_request paths filters on ten non-gating ecosystem compatibility workflows (Bun, Composer, Go, npm, pnpm, PDM, Pipenv, Poetry, sbt/Mill/scala-cli, vlt) so they no longer start when a PR only touches shared engine code (vendor/, patch/, vex/, scan/, Cargo.lock, broad crates/**, etc.).

Each workflow’s PR filter now lists that ecosystem’s workflow/scripts/docs, capstone tests/fixtures, and source globs named after the tool (e.g. crates/*/src/**/*npm* with pnpm exclusions for npm). Comments document that shared-engine changes still get the full matrix on push to main, workflow_dispatch, and (for vlt) existing schedules; ci.yml’s per-ecosystem blocking slice is unchanged on every PR (#1198).

For workflows that already path-filtered push (PDM, Bun, Poetry), push paths are widened so anything removed from the PR filter still triggers post-merge runs. scripts/tests/test_ci_vlt_rows.py now expects Cargo.lock, rust-toolchain.toml, and vendor/** only under vlt’s push trigger, not pull_request.

^{Reviewed by Cursor Bugbot for commit 9da4dfd. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

[final reviewer] Tanmay Singla (@Tanmay182003) One non-merge commit landed after your approval on ddd38f63: 9da4dfd Run sbt compat on Coursier and Ivy cache changes. It adds two path globs (crates/*/src/**/*coursier*, crates/*/src/**/*ivy*) to sbt-compatibility.yml's pull_request.paths, fixing Bugbot's finding that the Coursier/Ivy cache code (used only by sbt, Mill and scala-cli) matched no sbt trigger. CI is green on head 9da4dfd (ci-ok, clippy), the branch is mergeable and every thread is resolved. It isn't enqueued until you take another look at 9da4dfd.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9da4dfd. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down] Ready for review at 9da4dfdc2. CI 426/426 green (411 success, 15 skipped, incl. ci-ok); mergeable, no conflicts. Bugbot re-reviewed 9da4dfd with no new issues; its earlier finding (Coursier/Ivy paths missing from the sbt compat trigger) is fixed and resolved. The approval on ddd38f63 predates 9da4dfd, so this needs a fresh look at that commit.

---

Generated by Claude Code