ci(macos): split suite across four weighted shards - #7926

Summary

• Split platform-macos into four jobs named macos N/4, with matching TEST_SHARD=N/4. Keep the 20-minute job cap, process bounds, full membership, and failure policy. In dev run 40766068492, jobs 123090588998 and 123090589363 reached batches 73/88 and 93/93 before timing out without failing tests. Update the workflow evidence, shard assertions, four-way membership fixture, refresh usage, and structure/agent documentation.
• Regenerate the shared Linux/macOS weights with the existing duration tool: 16,617 observations from 21 successful suite jobs in 40727740334, 40743681086, and 40756291846. Those workflows failed overall; the selected jobs succeeded. All 2,776 current test files now have measured weights, including 534 previously unweighted files. Exclude cancelled jobs and leave Windows weights unchanged. Fixed four-way replay estimates 541.173–707.087 seconds per macOS shard; these are in-sample additive estimates, excluding setup, changed batch boundaries, and runner variance.
• Capacity tradeoff: four suite shards + control + widget/bundle request six macOS jobs for five slots, so at least one queues. The suite's maximum budget rises from 60 to 80 runner-minutes (+20, 33.3%); the same test payload is divided four ways. The nine historical macOS jobs spent 42–68 seconds each outside their test step, suggesting roughly one extra runner-minute of setup/cleanup, plus changed batch overhead. No trigger, permission, condition, action-reference, credential, or release-eligibility changes. The aggregate ci gate has a concrete leg count only for Windows (11); macOS uses its matrix rollup, so no macOS count constant needed changing there.

Verification

• bun install --frozen-lockfile — PASS, 106 packages installed; lockfile unchanged.
• Workflow regression: bun test tests/ci-workflows/ci-workflows.test.ts -t 'cross-platform CI keeps bounded jobs and immutable action references' — red with the old /3 workflow, then 1 pass / 0 fail / 136 assertions after the change. The test still requires timeout 20 and ties the matrix, job name, and divisor together.
• bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts — 29 pass, 0 fail, 579 assertions.
• bun run typecheck — PASS, 2,228 files. bun run structure:check, bun run privacy:scan, and git diff --check — PASS.
• node scripts/ci/test-durations.ts refresh with the 21 selected job logs — 2,776 files measured. Independent verification checked all input hashes, 16,617 observations, 2,776 rounded means, four-way assignments, and replay imputation counts. The generated table is byte-identical to the independently verified candidate. Earlier runs require median imputation for 6/3 current files; the latest requires none.
• Parsed-workflow comparison against base b16bc0978b2eef1799f38042084809b5a0cd11bf — only macOS name, matrix, and TEST_SHARD execution fields differ. Bounded independent technical audit: PASS, 0 blockers; this is not maintainer approval.
• bun run test tests/ci-workflows on final head 83fad0ffb7fd23858dc408fff1134abdc3fdea69 — FAILED: 1,518 pass, 241 skip, 54 fail, 5 errors across 90 files / 1,813 tests in 321.70 seconds. This is the prescribed isolated, four-worker harness. The macOS workflow guard and both committed-table checks passed on the refreshed data; broader subprocess/fixture cases hit their existing deadlines. Some failing cases are in unchanged portions of the large workflow test file. No base reproduction was run, so this is not claimed as proven inherited failure. Keep the PR draft; broad local validation is red.
• Noncanonical diagnostic bun test tests/ci-workflows — FAILED: 1,525 pass, 241 skip, 47 fail, 4 errors in 1,228.69 seconds. Many subprocess cases exceeded Bun's 5-second default. This invocation omitted the repository wrapper's file isolation, four workers, and OCX_TEST_FULL_SUITE=1; it is retained as failed evidence, not counted as passing. The canonical harness also reported timeout failures; no budgets, assertions, skips, or retry settings were changed. These failures have not been baselined on the base commit.
• NOT RUN: full 2,776-file runtime suite (disproportionate on this shared Windows host for a workflow/data change), POSIX-only shell cases skipped by existing Windows guards, or actual four-way macOS execution. Hosted Ubuntu PR CI and later maintainer batch validation remain separate evidence. No manual CI dispatch, rerun, force-push, stash, or merge.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Draft: explicit maintainer security review is required under MAINTAINERS.md for this workflow change, and broad local validation is not green. The technical audit and workflow-surface comparison do not replace that review. Do not merge as part of this task.

Summary by CodeRabbit

• CI Updates
  • Increased the macOS test suite from three shards to four. Each shard retains its 20-minute time limit while dividing the same suite, with some additional setup overhead.
  • A full cross-platform run requests at least six macOS jobs for five available runner slots, so some jobs may queue. The control job remains unchanged.
• Documentation
  • Updated CI guidance to reflect the four-shard layout, setup overhead, and runner capacity.