ci(parity): scope runtime matrix to affected commands on PR, full run daily

The runtime parity matrix (~113 real Docker cases) took ~45 min on every
push/PR. Split it so pushes/PRs only exercise the cases a change can affect,
and move the exhaustive run to a daily schedule.

  - selected() (parity matrix filter) now accepts a comma-separated allowlist,
    so PARITY_COMMAND="up,build" runs just those commands. Empty/"all" still
    means everything; unselected cases are "not-selected" and do not trip the
    strict gate.

  - .github/scripts/parity-affected.sh maps a changed-file list to a
    PARITY_COMMAND value: isolated leaf-command files narrow to that command
    (e.g. exec.go -> exec, gpu.go -> up), docs-only changes -> none, and any
    shared/core/uncertain file (config, docker, imagemeta, features, the
    harness, Taskfile, workflow) -> all. Conservative by construction: the
    default is "all".

  - Taskfile: parity:runtime reads PARITY_COMMAND to scope the matrix; the
    heavy, network-bound TestPublishParity moves to its own parity:publish.

  - CI: parity-runtime now runs only on push/PR, computes the affected commands
    from the diff, and skips entirely when nothing runtime-relevant changed.
    A new parity-runtime-full job runs the whole matrix + parity:publish on a
    daily cron (06:00 UTC) and on manual dispatch — the backstop for any
    cross-command effect the scoped run misses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aledbf

.github/scripts/parity-affected.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# Map a set of changed files (read from stdin, one path per line) to the parity
+# runtime commands they can affect, and print a single value on stdout:
+#
+#   all   -> run the whole runtime matrix (a shared/core or uncertain file changed)
+#   none  -> run nothing (only docs / irrelevant files changed, or no files)
+#   <csv> -> run only these commands, e.g. "up,build" (PARITY_COMMAND allowlist)
+#
+# The mapping is deliberately conservative: only files we are confident are
+# command-local narrow the run; everything else falls through to "all". The
+# daily full run is the backstop for any cross-command effect this misses.
+#
+# Usage:  git diff --name-only base...head | .github/scripts/parity-affected.sh
+set -euo pipefail
+
+full=0
+any=0
+declare -A cmds=()
+
+add() { cmds["$1"]=1; }
+
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  any=1
+  case "$f" in
+    # --- Ignorable: never affect the runtime matrix -------------------------
+    *.md | LICENSE* | .gitignore | .editorconfig | .github/CODEOWNERS)
+      : ;;
+    .github/workflows/release.yml | .goreleaser* )
+      : ;;
+
+    # --- Harness / matrix data / build config → run everything --------------
+    # (listed BEFORE the generic *_test.go ignore so it wins)
+    docs/parity/parity-matrix.yaml | \
+    internal/cli/parity_matrix_test.go | internal/cli/parity_matrix_helpers_test.go | \
+    Taskfile.yml | go.mod | go.sum | \
+    .github/workflows/go-cli.yml | .github/scripts/parity-affected.sh)
+      full=1 ;;
+
+    # --- Isolated leaf command files → just that command's cases ------------
+    internal/cli/read_configuration.go)                            add read-configuration ;;
+    internal/cli/exec.go)                                          add exec ;;
+    internal/cli/outdated.go)                                      add outdated ;;
+    internal/cli/features_info.go)                                 add features-info ;;
+    internal/cli/templates_apply.go | internal/cli/templates_metadata.go) add templates ;;
+    internal/cli/run_user_commands.go)                             add run-user-commands ;;
+    internal/cli/setup.go)                                         add set-up ;;
+    internal/cli/gpu.go | internal/cli/mounts.go | internal/cli/up.go) add up ;;
+    internal/cli/build.go | internal/cli/build_auth.go | internal/cli/cache_key.go) add build ;;
+    internal/cli/collection_commands.go)
+      add features; add templates; add features-info; add features-package ;;
+
+    # --- A command's own hermetic/e2e tests don't affect the runtime matrix -
+    # (they run in their own jobs). Ignore them for runtime selection.
+    internal/cli/*_test.go)
+      : ;;
+
+    # --- Anything else under the source tree is shared or uncertain → full --
+    internal/* | cmd/*)
+      full=1 ;;
+
+    # --- Unknown top-level path → be safe --------------------------------------
+    *)
+      full=1 ;;
+  esac
+done
+
+if [ "$full" -eq 1 ]; then
+  echo "all"
+  exit 0
+fi
+if [ "${#cmds[@]}" -eq 0 ]; then
+  # any==0 means an empty diff; either way there is nothing runtime-relevant.
+  echo "none"
+  exit 0
+fi
+
+# Join the selected command keys with commas, sorted for stable output.
+printf '%s\n' "${!cmds[@]}" | sort | paste -sd, -

.github/workflows/go-cli.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [main, master]
   workflow_dispatch: {}
+  schedule:
+    # Daily 06:00 UTC: the full runtime parity matrix + publish parity. On
+    # push/PR only the cases affected by the change run (see parity-runtime).
+    - cron: "0 6 * * *"
 
 jobs:
   lint-and-test:
@@ -103,9 +107,13 @@ jobs:
           path: artifacts/
           if-no-files-found: error
 
-  # Runtime lane of the parity matrix (creates real containers via Docker).
-  # ubuntu-latest ships with Docker preinstalled.
+  # Runtime lane of the parity matrix (creates real containers via Docker) on
+  # push/PR, SCOPED to the commands affected by the change: the full matrix takes
+  # ~45 min, so .github/scripts/parity-affected.sh maps the diff to a
+  # PARITY_COMMAND allowlist (or "all"/"none"). The daily parity-runtime-full job
+  # is the backstop that always runs the whole thing.
   parity-runtime:
+    if: github.event_name == 'push' || github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     needs: lint-and-test
     env:
@@ -117,12 +125,98 @@ jobs:
       - uses: actions/checkout@v7
         with:
           submodules: recursive
-      # The runtime matrix builds ~180 real images serially; they accumulate and
+          # Full history so the diff base (PR base / previous push) is present.
+          fetch-depth: 0
+      - name: Determine affected parity commands
+        id: affected
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            base="${{ github.event.pull_request.base.sha }}"
+            head="${{ github.event.pull_request.head.sha }}"
+          else
+            base="${{ github.event.before }}"
+            head="${{ github.sha }}"
+          fi
+          # New branch / unknown base (e.g. all-zero before-SHA) → run everything.
+          if [ -z "$base" ] || ! git cat-file -e "${base}^{commit}" 2>/dev/null; then
+            echo "commands=all" >> "$GITHUB_OUTPUT"; echo "run=true" >> "$GITHUB_OUTPUT"
+            echo "unknown base → running the full matrix"; exit 0
+          fi
+          files=$(git diff --name-only "$base" "$head")
+          echo "changed files:"; echo "$files"
+          cmds=$(printf '%s\n' "$files" | .github/scripts/parity-affected.sh)
+          echo "affected parity commands: $cmds"
+          echo "commands=$cmds" >> "$GITHUB_OUTPUT"
+          if [ "$cmds" = "none" ]; then
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "no runtime-relevant changes → skipping the runtime matrix"
+          else
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          fi
+      # The runtime matrix builds real images serially; they accumulate and
       # exhaust the runner's root disk ("No space left on device" — the runner then
       # dies hard, losing logs). /mnt is the SAME filesystem as / on these runners,
       # so it buys nothing; instead free the big preinstalled SDKs (Go/Node are
       # reinstalled by the setup steps that follow) for ~25-30GB of headroom. Also
       # enable the containerd image store (needed for cache export / --platform).
+      - name: Free disk space + configure Docker (containerd store)
+        if: steps.affected.outputs.run == 'true'
+        run: |
+          echo "before:"; df -h / | tail -1
+          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android \
+                      /opt/hostedtoolcache/CodeQL /usr/share/swift \
+                      /usr/local/share/boost /usr/lib/jvm || true
+          sudo docker image prune -af >/dev/null 2>&1 || true
+          echo "after:"; df -h / | tail -1
+          echo '{"features":{"containerd-snapshotter":true}}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+          docker info -f 'driver={{.DriverStatus}}'
+      - uses: actions/setup-go@v6
+        if: steps.affected.outputs.run == 'true'
+        with:
+          go-version-file: go.mod
+      - uses: actions/setup-node@v6
+        if: steps.affected.outputs.run == 'true'
+        with:
+          node-version: "20"
+      - uses: go-task/setup-task@v2
+        if: steps.affected.outputs.run == 'true'
+        with:
+          version: 3.x
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - if: steps.affected.outputs.run == 'true'
+        run: task reference
+      - if: steps.affected.outputs.run == 'true'
+        env:
+          PARITY_COMMAND: ${{ steps.affected.outputs.commands }}
+        run: task parity:runtime
+      - if: always() && steps.affected.outputs.run == 'true'
+        run: |
+          mkdir -p artifacts
+          git -C reference rev-parse HEAD > artifacts/reference-commit.txt
+      - uses: actions/upload-artifact@v7
+        if: always() && steps.affected.outputs.run == 'true'
+        with:
+          name: parity-runtime-v0.88.0
+          path: artifacts/
+          if-no-files-found: error
+      - if: always() && steps.affected.outputs.run == 'true'
+        run: task clean
+
+  # Full runtime parity matrix + publish parity. Runs once a day (schedule) and
+  # on manual dispatch — the exhaustive backstop for the scoped push/PR job above.
+  parity-runtime-full:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    needs: lint-and-test
+    env:
+      PARITY_RUNTIME_TIMEOUT: "10m"
+      PARITY_PARALLEL: "1"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
       - name: Free disk space + configure Docker (containerd store)
         run: |
           echo "before:"; df -h / | tail -1
@@ -147,14 +241,15 @@ jobs:
 
       - run: task reference
       - run: task parity:runtime
+      - run: task parity:publish
       - if: always()
         run: |
           mkdir -p artifacts
           git -C reference rev-parse HEAD > artifacts/reference-commit.txt
       - uses: actions/upload-artifact@v7
         if: always()
         with:
-          name: parity-runtime-v0.88.0
+          name: parity-runtime-full-v0.88.0
           path: artifacts/
           if-no-files-found: error
       - if: always()

Taskfile.yml

@@ -130,7 +130,7 @@ tasks:
       - PARITY_REPORT_FILE={{.ROOT_DIR}}/artifacts/parity-network.json PARITY_STRICT=true PARITY_LANE=all PARITY_NETWORK_ONLY=true PARITY_SKIP_DOCKER=true go test ./internal/cli -run TestParityMatrix -count=1 -timeout 15m -v {{.CLI_ARGS}}
 
   parity:runtime:
-    desc: Run the complete parity matrix with Docker
+    desc: Run the runtime parity matrix with Docker (set PARITY_COMMAND=up,build to scope it)
     deps: [build, reference:compile]
     preconditions:
       - sh: docker info >/dev/null 2>&1
@@ -152,7 +152,17 @@ tasks:
       # -parallel default 2 for gate determinism: higher values overload the docker
       # daemon on contended runners and transiently fail compose/heavy cases (they
       # match in isolation). Raise via PARITY_PARALLEL on beefy/idle runners.
+      # PARITY_COMMAND (comma-separated, inherited from the environment) scopes the
+      # run to the cases affected by a change; unset/"all" runs the full matrix.
       - PARITY_REPORT_FILE={{.ROOT_DIR}}/artifacts/parity-runtime.json PARITY_STRICT=true PARITY_LANE=all go test ./internal/cli -run TestParityMatrix -count=1 -parallel {{.PARITY_PARALLEL | default "2"}} -timeout 60m -v {{.CLI_ARGS}}
+
+  parity:publish:
+    desc: Run the OCI publish parity (features publish/package) — network + registry heavy
+    deps: [build, reference:compile]
+    preconditions:
+      - sh: docker info >/dev/null 2>&1
+        msg: Docker is required for publish parity
+    cmds:
       - go test ./internal/cli -run TestPublishParity -count=1 -timeout 10m -v
 
   clean:

internal/cli/parity_matrix_helpers_test.go

@@ -49,6 +49,27 @@ func TestMatchesFilter_NetworkOnly(t *testing.T) {
 	}
 }
 
+func TestSelected_CommaList(t *testing.T) {
+	cases := []struct {
+		value, filter string
+		want          bool
+	}{
+		{"up", "", true},                // empty matches all
+		{"up", "all", true},             // "all" matches all
+		{"up", "up", true},              // single exact
+		{"up", "build", false},          // single mismatch
+		{"up", "up,build", true},        // list contains
+		{"build", "up,build", true},     // list contains (2nd)
+		{"exec", "up,build", false},     // list excludes
+		{"build", " up , build ", true}, // whitespace tolerated
+	}
+	for _, c := range cases {
+		if got := selected(c.value, c.filter); got != c.want {
+			t.Errorf("selected(%q, %q) = %v, want %v", c.value, c.filter, got, c.want)
+		}
+	}
+}
+
 func TestWriteParityReport(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "nested", "report.json")
 	want := map[parityOutcome][]string{parityMatched: {"a"}, parityInconclusive: {"b"}}

internal/cli/parity_matrix_test.go

@@ -1093,8 +1093,20 @@ func matchesFilter(tc parityCase) bool {
 		selected(tc.CurrentStatus, os.Getenv("PARITY_STATUS"))
 }
 
+// selected reports whether value passes a filter. An empty filter or "all"
+// matches everything; otherwise the filter is a comma-separated allowlist and
+// value must equal one of its (trimmed) entries. The list form lets CI run the
+// cases affected by a change, e.g. PARITY_COMMAND="up,build".
 func selected(value, filter string) bool {
-	return filter == "" || filter == "all" || value == filter
+	if filter == "" || filter == "all" {
+		return true
+	}
+	for _, f := range strings.Split(filter, ",") {
+		if strings.TrimSpace(f) == value {
+			return true
+		}
+	}
+	return false
 }
 
 func selectedSubstring(value, filter string) bool {