ci: run the macOS and Windows jobs on main, or by label - #87
Merged
Conversation
September's Actions usage for this organization was 11,883 Linux minutes, 4,407 macOS and 2,819 Windows. macOS bills at ten times the Linux rate and Windows at twice it, so those two account for most of a $373 gross that the included allowance covered almost exactly -- and jobs then stopped starting at all. Four jobs now wait for main: phase1-conformance (macos-15), rust (macos-latest), windows-supervisor-behavior (windows-2025), and the darwin-arm64 half of unix-supervisor. linux-x64 keeps running on every branch, as do web, e2e, contract-canary, and desktop. `rust` cannot simply move to Linux: it cross-builds the Windows supervisor from an arm64 Homebrew mingw-w64 bottle pinned by digest, so gating it is the only lever that does not rewrite the toolchain. That gate would otherwise make some branches unverifiable -- the two open pull requests touching src-tauri and the Windows supervisor are exactly the ones that need these jobs -- so a pull request can ask for them by carrying the `ci:full` label. Any branch touching src-tauri or the supervisors should. A matrix entry cannot carry its own condition, so unix-supervisor selects its include list with the same expression instead of an `if`. The two guards that encoded the old policy now encode this one, and assert more than they did: every expensive job still gates on docs_only -- the list grew to include windows-supervisor-behavior, which the previous anchored regex silently missed -- and each gated job must carry both halves of the main-or-label condition. ci.yml is pinned by digest in the harness authority, so its blob and SHA-256 in phase1-conformance.lock.json move with it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KacEJmkX5GhkViPUhx9Mie
Copilot stopped reviewing on behalf of
BunsDev due to an error
September 4, 2026 03:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CI stopped running entirely — jobs began failing with zero steps and the annotation "The job was not started because recent account payments have failed or your spending limit needs to be increased."
The org's September Actions usage says why:
Gross $373.37, discount $372.74 — the included allowance was consumed almost exactly. macOS and Windows are a quarter of the minutes and the large majority of the cost.
What changes
Four jobs now run on
mainonly:phase1-conformance(macos-15)rust(macos-latest)windows-supervisor-behavior(windows-2025)darwin-arm64half ofunix-supervisor(macos-14)linux-x64still runs on every branch, as doweb,e2e,contract-canary, anddesktop. Pull requests keep lint, typecheck, unit, E2E, desktop build, and the contract canary.rustcannot just move to Linux. It cross-builds the Windows supervisor from an arm64 Homebrewmingw-w64bottle pinned by digest, so gating is the only lever that does not rewrite that toolchain.The
ci:fullescape hatchGating alone would make some branches unverifiable — and the two open PRs (#84, #85) touch
src-tauriand the Windows supervisor, exactly the code these jobs cover. So a pull request can request them by carrying theci:fulllabel. Any branch touchingsrc-taurior the supervisors should.A matrix entry cannot carry its own
if, sounix-supervisorselects its include list with the same expression instead.Guards
The two tests that encoded the old policy now encode this one, and assert more than before:
docs_only— and the list grew to includewindows-supervisor-behavior, which the previous anchored regex silently missed;unix-supervisormust still be able to reach both platforms, with macOS as the gated half.ci.ymlis pinned by digest in the harness authority, so its blob and SHA-256 inphase1-conformance.lock.jsonmove with it.Validation
pnpm test:unit— 473 passed / 61 skipped across 31 files, including both updated guards. YAML parses; the gated conditions were verified job by job.