perf(ci): only boot a macOS runner when native sources actually change (#51)

Mobile Native Static Analysis runs swiftlint, ktlint, and detekt, which
between them read only .swift, .kt, and .kts files under apps/mobile,
skipping the generated android/ and ios/ folders. It needs macOS, the most
expensive runner tier this repo buys, and it ran on every pull request and
every push regardless of what changed: 157 times over the last 30 days for
about four seconds of actual linting behind roughly forty seconds of
runner setup.

Moving it into its own workflow lets GitHub path-filter it natively, with
no extra gate job and no new action dependency. Filtering on apps/mobile/**
would have been the obvious choice and the wrong one: 18 of the last 40
merged pull requests touched something under apps/mobile, but only 3
touched native sources or the linter configuration, so the broad filter
would still boot macOS six times more often than the check can do any
work.

The paths list is load-bearing. Widen it whenever the check learns to read
something new, or it will quietly stop running.

Verified with actionlint: no new findings against the base.

Model: Claude Opus 5. Harness: Claude Code.

Author: rynfar

.github/workflows/ci-mobile-native.yml

@@ -0,0 +1,70 @@
+name: CI Mobile Native
+
+# Split out of ci.yml so it can be path-filtered. The job needs a macOS runner
+# for swiftlint, and macOS is the most expensive tier we buy, but the check it
+# runs only ever reads .swift/.kt/.kts under apps/mobile -- roughly four seconds
+# of actual linting behind about forty seconds of runner setup. Filtering on
+# apps/mobile/** would still be wrong: only 3 of the last 40 merged PRs touched
+# native sources, while 18 touched something under apps/mobile, so the broad
+# filter would boot macOS six times more often than the check can do any work.
+on:
+  pull_request:
+    paths:
+      - "apps/mobile/**/*.swift"
+      - "apps/mobile/**/*.kt"
+      - "apps/mobile/**/*.kts"
+      - "apps/mobile/.swiftlint.yml"
+      - "apps/mobile/detekt.yml"
+      - "apps/mobile/.editorconfig"
+      - "apps/mobile/Brewfile"
+      - "scripts/mobile-native-static-check.ts"
+      - ".github/workflows/ci-mobile-native.yml"
+  push:
+    branches:
+      - pylon
+    paths:
+      - "apps/mobile/**/*.swift"
+      - "apps/mobile/**/*.kt"
+      - "apps/mobile/**/*.kts"
+      - "apps/mobile/.swiftlint.yml"
+      - "apps/mobile/detekt.yml"
+      - "apps/mobile/.editorconfig"
+      - "apps/mobile/Brewfile"
+      - "scripts/mobile-native-static-check.ts"
+      - ".github/workflows/ci-mobile-native.yml"
+
+concurrency:
+  group: ci-mobile-native-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  mobile_native_static_analysis:
+    name: Mobile Native Static Analysis
+    runs-on: blacksmith-6vcpu-macos-26
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: |
+            args:
+              - --filter=@t3tools/scripts...
+
+      - name: Install mobile native static analysis tools
+        run: brew bundle install --file apps/mobile/Brewfile
+
+      - name: Lint mobile native sources
+        run: vp run lint:mobile

.github/workflows/ci.yml

@@ -118,34 +118,6 @@ jobs:
       - name: Test resource monitor
         run: cargo test --locked --manifest-path native/resource-monitor/Cargo.toml
 
-  mobile_native_static_analysis:
-    name: Mobile Native Static Analysis
-    runs-on: blacksmith-6vcpu-macos-26
-    timeout-minutes: 10
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          sparse-checkout: |
-            /*
-            !/.repos/
-          sparse-checkout-cone-mode: false
-
-      - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@v1
-        with:
-          node-version-file: package.json
-          cache: true
-          run-install: |
-            args:
-              - --filter=@t3tools/scripts...
-
-      - name: Install mobile native static analysis tools
-        run: brew bundle install --file apps/mobile/Brewfile
-
-      - name: Lint mobile native sources
-        run: vp run lint:mobile
-
   release_smoke:
     name: Release Smoke
     runs-on: blacksmith-8vcpu-ubuntu-2404

docs/internals/ci.md

@@ -2,19 +2,25 @@
 
 > For maintainers. Using T3 Code? See [docs/user](../user/).
 
-[`.github/workflows/ci.yml`](../../.github/workflows/ci.yml) runs four jobs on pull requests and
-pushes to `main`:
+[`.github/workflows/ci.yml`](../../.github/workflows/ci.yml) runs three jobs on pull requests and
+pushes to `pylon`:
 
 - **Check**: `vp check` (format and lint; this repo sets `typeCheck: false` in its lint options),
   then `vpr typecheck` for the workspace type check. The same job
   builds the desktop pipeline (`vp run build:desktop`) and verifies the preload bundle exists and
   still exports its expected symbols.
 - **Test**: `vp run test` across the workspace.
-- **Mobile Native Static Analysis**: `vp run lint:mobile` on macOS, wrapping
-  `scripts/mobile-native-static-check.ts`.
 - **Release Smoke**: exercises release-only workflow steps through `scripts/release-smoke.ts`, so
   release breakage surfaces on PRs rather than at tag time.
 
+[`.github/workflows/ci-mobile-native.yml`](../../.github/workflows/ci-mobile-native.yml) runs
+**Mobile Native Static Analysis** (`vp run lint:mobile`, wrapping
+`scripts/mobile-native-static-check.ts`) on the same events. It lives in its own workflow so it can
+be path-filtered: the check only reads `.swift`, `.kt`, and `.kts` sources under `apps/mobile`, and
+it needs a macOS runner, which is the most expensive tier we buy. Filtering on `apps/mobile/**`
+would not be enough — most changes there are TypeScript the native linters never look at. Widen the
+`paths:` list whenever the check learns to read something new, or it will silently stop running.
+
 `.github/workflows/release.yml` builds macOS (`arm64` and `x64`), Linux (`x64`), and Windows (`x64`)
 desktop artifacts from a single `v*.*.*` tag and publishes one GitHub release. It auto-enables
 signing only when platform credentials are present. macOS passkey builds additionally require