improvement(ci): scope type checks and right-size hosted runners

Author: waleedlatif1

.github/CI.md

@@ -6,7 +6,7 @@ A PR compares its merge base with the checked-out merge commit. Pushes and norma
 
 | Change | Expensive checks selected |
 | --- | --- |
-| Independent SDK | That workspace's tests; no app build, services, or browsers |
+| Independent SDK | That workspace's tests and type-check; no app build, services, or browsers |
 | App unit test | App test shards and test type check |
 | Integration test | Both provision paths; no HTTP/browser job merely for the test edit |
 | Workspace UI | Mobile and live Electron, plus app tests/build |
@@ -18,7 +18,9 @@ The server boundary deliberately includes all API routes and backend domains. Sh
 
 `affectedTasks` already uses task inputs. Do not enable `futureFlags.affectedUsingTaskInputs` just for this planner: that flag also changes pruning, which can pull CI-only cross-app task dependencies into production Docker contexts.
 
-Lightweight HTTP suites and database integration run on free standard GitHub runners. Memory-heavy builds and browser/Electron jobs retain appropriately sized Blacksmith runners.
+Affected type-checks follow the package graph too; repository audits and lint always run. Workspace-only unit jobs use a free GitHub runner and do not start the app test shards.
+
+Lightweight HTTP suites and database integration run on free standard GitHub runners. Memory-heavy builds and browser jobs retain appropriately sized Blacksmith runners. Electron uses 4-vCPU Blacksmith: both shards passed within 14 seconds of the 8-vCPU control; the free GitHub rest shard was slower and its lease run stalled.
 
 Every HTTP and browser group consumes the same production build in an isolated job/database. Electron also uses that build and skips its development-route warm-up. Local HTTP and Electron development runs retain their dev-server behavior. Build inputs exclude test-only files so a harness edit can reuse an unchanged production build.
 

.github/ci-suites.json

@@ -19,6 +19,10 @@
     {
       "group": "seo",
       "task": "ci:e2e-seo"
+    },
+    {
+      "group": "project-files",
+      "task": "ci:e2e-project-files"
     }
   ],
   "production": [
@@ -53,14 +57,6 @@
       "shard": "2/2",
       "artifact": "mobile-webkit-2",
       "task": "ci:e2e-mobile"
-    },
-    {
-      "group": "project-files",
-      "name": "project-files",
-      "browser": "",
-      "shard": "",
-      "artifact": "project-files",
-      "task": "ci:e2e-project-files"
     }
   ]
 }

.github/scripts/ci-plan.gql

@@ -1,7 +1,7 @@
 query($base: String!, $head: String!) {
   packages { items { name path } }
   affectedTasks(base: $base, head: $head, tasks: [
-    "test", "build", "ci:integration", "ci:desktop-live",
+    "test", "build", "type-check", "ci:integration", "ci:desktop-live",
     "ci:e2e-scim", "ci:e2e-cli", "ci:e2e-stop-after", "ci:e2e-desktop-inbox",
     "ci:e2e-project-files", "ci:e2e-mobile", "ci:e2e-seo"
   ]) {

.github/workflows/checks.yml

@@ -36,6 +36,7 @@ jobs:
       production_matrix: ${{ steps.classify.outputs.production_matrix }}
       test_matrix: ${{ steps.classify.outputs.test_matrix }}
       test_packages: ${{ steps.classify.outputs.test_packages }}
+      typecheck_packages: ${{ steps.classify.outputs.typecheck_packages }}
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
@@ -214,9 +215,9 @@ jobs:
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
-      # The desktop executor uses Redis.
+      # Desktop inbox and Project Files use Redis.
       redis:
-        image: redis:8.2-alpine
+        image: ${{ (matrix.group == 'desktop-inbox' || matrix.group == 'project-files') && 'redis:8.2-alpine' || '' }}
         ports:
           - 6379:6379
         options: >-
@@ -228,6 +229,7 @@ jobs:
       DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_test
       BETTER_AUTH_SECRET: http-e2e-ci-secret-at-least-32-characters
       E2E_APP_SERVER: start
+      PROJECT_FILES_E2E_APP_SERVER: start
       ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000'
 
     steps:
@@ -241,6 +243,7 @@ jobs:
 
       # Migrations create their own extensions, as on a fresh self-hosted install.
       - name: Provision the database through migrations
+        if: matrix.group != 'project-files'
         working-directory: packages/db
         run: bun run db:migrate
 
@@ -262,6 +265,17 @@ jobs:
             apps/sim/.next/prerender-manifest.json > /dev/null ||
             { echo "::error::The build prerendered posts (a hosted build) or has no prerender manifest."; exit 1; }
 
+      # JOBS=4 caps node-gyp parallelism as docker/app.Dockerfile does (laverdet/isolated-vm#428).
+      - name: Build native isolate addon for Project file rendering
+        if: matrix.group == 'project-files'
+        working-directory: apps/sim
+        env:
+          JOBS: 4
+        run: |
+          addon_dir="$(node -p 'require("node:path").dirname(require.resolve("isolated-vm/package.json", { paths: ["."] }))')"
+          cd "$addon_dir"
+          bun run install
+
       # No step timeout: the job's bound covers a hang without cutting a slow but healthy suite
       # short of writing its report.
       - name: Run end-to-end suites
@@ -286,7 +300,7 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
-  # Browser and Project Files suites reuse the production build, avoiding dev-route compiles.
+  # Browser suites reuse the production build, avoiding dev-route compiles.
   # Each job has its own database and runtime flags; the build reads public env at startup.
   # Each browser partitions the full viewport list across two shards, including future additions.
   #
@@ -316,15 +330,6 @@ jobs:
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
-      redis:
-        image: ${{ matrix.group == 'project-files' && 'redis:8.2-alpine' || '' }}
-        ports:
-          - 6379:6379
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
     env:
       DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_test
       BETTER_AUTH_SECRET: http-e2e-ci-secret-at-least-32-characters
@@ -338,11 +343,11 @@ jobs:
       # setup action's caches.
       - &checkout-mirror
         name: Checkout code (mirror)
-        if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
+        if: (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
         uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
       - &checkout-plain
         name: Checkout code
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
+        if: (vars.CI_PROVIDER != '' && vars.CI_PROVIDER != 'blacksmith') || github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
 
 
@@ -352,30 +357,17 @@ jobs:
           provider: ${{ vars.CI_PROVIDER }}
 
       - name: Provision the database through migrations
-        if: matrix.group != 'project-files'
         working-directory: packages/db
         run: bun run db:migrate
 
       - *download-e2e-build
       - *extract-e2e-build
 
-      # JOBS=4 caps node-gyp parallelism as docker/app.Dockerfile does (laverdet/isolated-vm#428).
-      - name: Build native isolate addon for Project file rendering
-        if: matrix.group == 'project-files'
-        working-directory: apps/sim
-        env:
-          JOBS: 4
-        run: |
-          addon_dir="$(node -p 'require("node:path").dirname(require.resolve("isolated-vm/package.json", { paths: ["."] }))')"
-          cd "$addon_dir"
-          bun run install
-
       - name: Run end-to-end suites
         working-directory: apps/sim
         env:
           MOBILE_E2E_BROWSER: ${{ matrix.browser }}
           MOBILE_E2E_SHARD: ${{ matrix.shard }}
-          PROJECT_FILES_E2E_APP_SERVER: start
         run: bash ../../.github/scripts/http-e2e.sh "${{ matrix.group }}"
 
       - name: Upload end-to-end reports and server logs
@@ -397,13 +389,14 @@ jobs:
           retention-days: 7
 
   # Desktop tools exercise the real Electron app against the shared production build.
+  # Hosted 4-vCPU runs passed both shards within 14 seconds of 8-vCPU; production peak ~4 GB.
   # Two runners: the lease-lapse test sleeps through a long import and then a lease (~3 min), as
   # long as the rest of the spec together, so on one runner it set the time for every run.
   desktop-live:
     name: desktop-live (${{ matrix.tests }})
     needs: [changes, e2e-build]
     if: needs.changes.outputs.desktop_live == 'true'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -557,6 +550,7 @@ jobs:
   # kept off the test shards so neither waits on the other.
   lint:
     name: lint
+    needs: changes
     runs-on: &runner-4vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
 
@@ -569,16 +563,14 @@ jobs:
       # Worth stating because the failure was invisible for so long: the migration
       # audit read the resulting `git diff` failure as "no migrations changed" and
       # exited 0, so it had never actually run on a push build.
-      # Same mirror/plain split as the integration job's checkout.
-      - &checkout-mirror-depth2
-        name: Checkout code (mirror)
-        if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
+      # Same provider/trust split as the build jobs' checkout.
+      - name: Checkout code (mirror)
+        if: (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
         uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
         with:
           fetch-depth: 2
-      - &checkout-plain-depth2
-        name: Checkout code
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
+      - name: Checkout code
+        if: (vars.CI_PROVIDER != '' && vars.CI_PROVIDER != 'blacksmith') || github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           fetch-depth: 2
@@ -689,14 +681,23 @@ jobs:
       - name: Migration safety (zero-downtime) audit
         run: bun run check:migrations "${{ steps.audit_base.outputs.ref }}"
 
-      # Every workspace, not just realtime. packages/emcn, packages/utils,
+      # Every affected workspace, following the same real task graph as tests. Root/unknown
+      # changes select all. packages/emcn, packages/utils,
       # apps/desktop and apps/docs had no type check in CI at all; apps/sim's
       # source was covered only as a side effect of `next build` in the separate
       # `build` job. This does NOT cover apps/sim's tests — its tsconfig
       # excludes *.test.ts(x), which carry ~2.2k errors; the `test-types` job
       # ratchets those per file instead.
-      - name: Type-check all workspaces
-        run: bunx turbo run type-check
+      - name: Type-check affected workspaces
+        env:
+          TYPECHECK_PACKAGES: ${{ needs.changes.outputs.typecheck_packages }}
+        run: |
+          jq -e 'type == "array" and all(.[]; type == "string")' <<< "$TYPECHECK_PACKAGES" > /dev/null
+          filters=()
+          while IFS= read -r package; do filters+=("--filter=$package"); done < <(jq -r '.[]' <<< "$TYPECHECK_PACKAGES")
+          if [ "${#filters[@]}" -gt 0 ]; then
+            bunx turbo run type-check "${filters[@]}"
+          fi
 
       - name: Check schema and migrations are in sync
         working-directory: packages/db
@@ -754,21 +755,29 @@ jobs:
     name: test (${{ matrix.shard }}/${{ needs.changes.outputs.test_app == 'true' && '2' || '1' }})
     needs: changes
     if: needs.changes.outputs.test == 'true'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: ${{ needs.changes.outputs.test_app == 'true' && (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
     timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.changes.outputs.test_matrix) }}
 
 
     steps:
-      - *checkout-mirror-depth2
-      - *checkout-plain-depth2
+      - name: Checkout code (mirror)
+        if: needs.changes.outputs.test_app == 'true' && (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
+        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
+        with:
+          fetch-depth: 2
+      - name: Checkout code
+        if: needs.changes.outputs.test_app != 'true' || (vars.CI_PROVIDER != '' && vars.CI_PROVIDER != 'blacksmith') || github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          fetch-depth: 2
 
       - name: Setup workspace
         uses: ./.github/actions/setup
         with:
-          provider: ${{ vars.CI_PROVIDER }}
+          provider: ${{ needs.changes.outputs.test_app != 'true' && 'github' || vars.CI_PROVIDER }}
           turbo-cache-key: turbo-cache-test-${{ matrix.shard }}
 
       # cloud-review-tools.test.ts runs the real helper on the runner, which shells
@@ -805,6 +814,7 @@ jobs:
         run: |
           if [ "$SHARD" = 1 ]; then
             bun run test:scripts
+            jq -e 'type == "array" and all(.[]; type == "string")' <<< "$TEST_PACKAGES" > /dev/null
             filters=()
             while IFS= read -r package; do filters+=("--filter=$package"); done < <(jq -r '.[]' <<< "$TEST_PACKAGES")
             if [ "${#filters[@]}" -gt 0 ]; then
@@ -971,6 +981,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          sparse-checkout: .github/scripts
       - name: Require every check to pass
         env:
           NEEDS: ${{ toJSON(needs) }}

scripts/ci-changes.test.ts

@@ -13,6 +13,7 @@ interface Plan {
   fallback?: string
   http: { group: string }[]
   production: { group: string }[]
+  typecheckPackages: string[]
   testPackages: string[]
 }
 function git(cwd: string, ...args: string[]) {
@@ -58,7 +59,11 @@ function fixture() {
   ).scripts
   const workspaces: Record<string, unknown> = { '': { name: 'ci-fixture' } }
   for (const [path, name, dependencies] of packages) {
-    const scripts: Record<string, string> = { test: 'echo test', build: 'echo build' }
+    const scripts: Record<string, string> = {
+      test: 'echo test',
+      build: 'echo build',
+      'type-check': 'echo types',
+    }
     if (name === '@sim/app')
       for (const key of Object.keys(appScripts))
         if (key.startsWith('ci:')) scripts[key] = 'echo fixture'
@@ -124,6 +129,7 @@ describe('CI task attribution through real Turborepo', () => {
     expect(plan.fallback).toBeUndefined()
     expect(groups(plan)).toEqual([])
     expect(plan.testPackages).toEqual(['simstudio-ts-sdk'])
+    expect(plan.typecheckPackages).toEqual(['simstudio-ts-sdk'])
     expect(plan.flags).toMatchObject({
       test: true,
       test_app: false,
@@ -194,6 +200,8 @@ describe('CI task attribution through real Turborepo', () => {
     const plan = classifyFiles([`apps/sim/scripts/${file}`])
     expect(plan.fallback).toBeUndefined()
     expect(groups(plan)).toEqual([group])
+    expect(plan.flags.http).toBe(group !== 'mobile')
+    expect(plan.flags.production).toBe(group === 'mobile')
     expect(plan.flags).toMatchObject({
       test: false,
       build: false,
@@ -213,6 +221,8 @@ describe('CI task attribution through real Turborepo', () => {
       'seo',
       'stop-after',
     ])
+    expect(plan.typecheckPackages).toContain('@sim/app')
+    expect(plan.typecheckPackages).toContain('@sim/realtime')
     expect(plan.flags).toMatchObject({
       integration: true,
       desktop_live: true,

scripts/ci-plan.ts

@@ -98,15 +98,19 @@ const http = suites.http.filter((suite) => affected(suite.task))
 const production = suites.production.filter((suite) => affected(suite.task))
 const desktopLive = affected('ci:desktop-live')
 const appTest = affected('test')
-const packages = fallback
-  ? ['*']
-  : [
-      ...new Set(
-        tasks
-          .filter((task) => task.name === 'test' && task.package.name !== '@sim/app')
-          .map((task) => task.package.name)
-      ),
-    ].sort()
+function taskPackages(name: string, omitApp = false): string[] {
+  return fallback
+    ? ['*']
+    : [
+        ...new Set(
+          tasks
+            .filter((task) => task.name === name && (!omitApp || task.package.name !== '@sim/app'))
+            .map((task) => task.package.name)
+        ),
+      ].sort()
+}
+const packages = taskPackages('test', true)
+const typecheckPackages = taskPackages('type-check')
 const flags = {
   integration: affected('ci:integration'),
   http: http.length > 0,
@@ -123,6 +127,7 @@ const outputs = {
   production_matrix: JSON.stringify({ include: production }),
   test_matrix: JSON.stringify({ shard: appTest ? [1, 2] : [1] }),
   test_packages: JSON.stringify(packages),
+  typecheck_packages: JSON.stringify(typecheckPackages),
 }
 const report = {
   base,
@@ -134,6 +139,7 @@ const report = {
   http,
   production,
   testPackages: packages,
+  typecheckPackages,
 }
 if (process.env.CI_PLAN_PATH)
   writeFileSync(process.env.CI_PLAN_PATH, `${JSON.stringify(report, null, 2)}\n`)