ci: fast component checks and prepared releases under a five-minute publish budget

.github/workflows/codeql.yml

@@ -1,23 +1,16 @@
 name: CodeQL
 
-# Static analysis of the code we write, in the four languages of the repository. The findings appear under
-# Security -> Code scanning; the job log prints a summary of what the analysis found, so a run can be read without
-# the Security tab. What runs where and how to triage an alert: docs/operations/supply-chain.md.
-
+# Static analysis runs in qualification; regular edits use fast component CI.
 on:
-  push:
-    branches: [main]
-  pull_request:
-  schedule:
-    - cron: "31 3 * * 2"
+  workflow_call:
   workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: codeql-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: codeql-${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
 
 jobs:
   analyze:
@@ -29,6 +22,7 @@ jobs:
       security-events: write # upload the SARIF results
       actions: read
     strategy:
+      max-parallel: 2
       fail-fast: false
       matrix:
         include:

.github/workflows/containers.yml

@@ -1,67 +1,15 @@
 name: Containers
 
-# Proves that "install it and run it" works, with the files in deploy/ and not just with their syntax:
-#
-#   image       builds deploy/docker/Dockerfile (buildx + the gha layer cache; the `ui` stage builds the Web UI that
-#               ag-server embeds), checks size, user, health check and `--version`, runs it hardened (read-only
-#               root, no capabilities), checks that it serves the Web UI, and drives the end-to-end smoke
-#               (scripts/e2e_smoke.py) against it; its artifacts feed the next two jobs
-#
-# This is the only place images are built on push/PR: ci.yml used to repeat the build in an `images` job (a second
-# cache scope and the same two builds), which is why it is gone. The path filters below are what the image is
-# made of, so a change that cannot alter an image does not build one.
-#   cache       a fresh runner rebuilds from the gha cache and must find the expensive layers CACHED
-#   compose     `docker compose up` of deploy/compose (server + PostgreSQL + SeaweedFS (S3)), the same smoke against it
-#               (repository metadata in PostgreSQL, objects in an S3 bucket), a restart, then the observability profile
-#   kubernetes  a kind cluster, deploy/kubernetes (base through the ci overlay), the same smoke through
-#               `kubectl port-forward`, a rollout restart
-#
-# The smoke is a real integration: create a repository, grant roles, mint credentials, `ag clone`, snapshot,
-# `ag push`, integrate through the server, read the result back over the HTTP API, and assert the metrics.
-
+# Container build, cache and deployment smoke checks for qualification or explicit runs.
 on:
-  push:
-    branches: [main]
-    paths:
-      # A release request requires this workflow on the exact main commit.
-      - "CHANGELOG.md"
-      - "deploy/**"
-      - "crates/**"
-      - "proto/**"
-      - "migrations/**"
-      - "apps/web/**"
-      - "scripts/build_ui.sh"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "LICENSE"
-      - "NOTICE"
-      - ".dockerignore"
-      - "scripts/e2e_*.py"
-      - "scripts/check_buildx_cache.py"
-      - ".github/workflows/containers.yml"
-  pull_request:
-    paths:
-      - "deploy/**"
-      - "crates/**"
-      - "proto/**"
-      - "migrations/**"
-      - "apps/web/**"
-      - "scripts/build_ui.sh"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "LICENSE"
-      - "NOTICE"
-      - ".dockerignore"
-      - "scripts/e2e_*.py"
-      - "scripts/check_buildx_cache.py"
-      - ".github/workflows/containers.yml"
+  workflow_call:
   workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: containers-${{ github.ref }}
+  group: containers-${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
 env:

.github/workflows/docs.yml

@@ -1,28 +1,28 @@
 name: Docs
 
-# The documentation site (MkDocs Material, docs/ is the source of truth), the tutorials' commands run against the real
-# binaries, and the deploy to GitHub Pages.
-#
-#   site      builds the site with `mkdocs build --strict` on every push and pull request: a broken link, a broken
-#             #anchor or a page missing from the navigation fails the build.
-#   snippets  builds `ag` and `ag-server` and runs every command of the tutorials (scripts/doc_snippets.py), checks
-#             that the output the pages show is what the commands print, and that the policy documents of the
-#             cookbook go through the real parser.
-#   deploy    publishes the site from main to GitHub Pages, but only when Pages is enabled for the repository
-#             (Settings, Pages, Source: GitHub Actions). When it is not, the job says so and succeeds: the build above
-#             is still checked, nothing is published. It never runs for pull requests.
-
+# Fast site checks/deployment for documentation edits; executable tutorials run during qualification.
 on:
   push:
     branches: [main]
+    paths: ["docs/**", "README*", "ROADMAP.md", "SECURITY.md", "CONTRIBUTING.md", "mkdocs.yml", ".github/workflows/docs.yml"]
   pull_request:
+    paths: ["docs/**", "README*", "ROADMAP.md", "SECURITY.md", "CONTRIBUTING.md", "mkdocs.yml", ".github/workflows/docs.yml"]
   workflow_dispatch:
+    inputs:
+      full:
+        type: boolean
+        default: true
+  workflow_call:
+    inputs:
+      full:
+        type: boolean
+        default: true
 
 permissions:
   contents: read
 
 concurrency:
-  group: docs-${{ github.ref }}
+  group: docs-${{ github.ref }}-${{ inputs.full && 'full' || 'fast' }}-${{ github.workflow }}
   cancel-in-progress: true
 
 env:
@@ -60,6 +60,7 @@ jobs:
           retention-days: 7
 
   snippets:
+    if: inputs.full
     name: tutorials run against the real binaries
     runs-on: ubuntu-latest
     steps:
@@ -70,6 +71,8 @@ jobs:
         with:
           toolchain: stable
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          cache-workspace-crates: true
       - name: Build ag and ag-server
         run: cargo build -p agentgit-cli -p agentgit-server
       - name: The harness has tests of its own
@@ -81,8 +84,8 @@ jobs:
 
   deploy:
     name: deploy to GitHub Pages
-    needs: [site, snippets]
-    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    needs: site
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: read