ci: reduce runner occupancy in release and contract jobs (#28930)

.github/workflows/release-cut.yml

@@ -2336,6 +2336,11 @@ jobs:
     permissions:
       actions: write
       contents: read
+    outputs:
+      run_id: ${{ steps.dispatch.outputs.run_id }}
+      workflow_sha: ${{ steps.dispatch.outputs.workflow_sha }}
+      run_attempt: ${{ steps.dispatch.outputs.run_attempt }}
+      wait_deadline_ms: ${{ steps.dispatch.outputs.wait_deadline_ms }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -2346,7 +2351,8 @@ jobs:
           node-version-file: package.json
 
       - name: Run isolated macOS release build
-        run: node config/scripts/run-release-mac-build-workflow.mjs
+        id: dispatch
+        run: node config/scripts/run-release-mac-build-workflow.mjs dispatch
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_MAC_BUILD_REF: ${{ github.ref_name }}
@@ -2355,11 +2361,50 @@ jobs:
           RELEASE_MAC_BUILD_TAG: ${{ needs.cut.outputs.tag }}
           RELEASE_MAC_BUILD_WORKFLOW: release-mac-build.yml
 
+  verify-mac-build:
+    needs:
+      - cut
+      - build-mac
+      - build
+    # Qualify macOS even when a sibling build fails; publication still requires every build.
+    if: >-
+      !cancelled() &&
+      needs.cut.result == 'success' &&
+      needs.cut.outputs.should_release == 'true' &&
+      needs.build-mac.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 95
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+
+      - name: Require the exact isolated macOS release build to succeed
+        run: node config/scripts/run-release-mac-build-workflow.mjs wait
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_MAC_BUILD_REF: ${{ github.ref_name }}
+          RELEASE_MAC_BUILD_RELEASE_RUN_ID: ${{ github.run_id }}
+          RELEASE_MAC_BUILD_RUN_ID: ${{ needs.build-mac.outputs.run_id }}
+          RELEASE_MAC_BUILD_WORKFLOW_SHA: ${{ needs.build-mac.outputs.workflow_sha }}
+          RELEASE_MAC_BUILD_RUN_ATTEMPT: ${{ needs.build-mac.outputs.run_attempt }}
+          RELEASE_MAC_BUILD_WAIT_DEADLINE_MS: ${{ needs.build-mac.outputs.wait_deadline_ms }}
+          RELEASE_MAC_BUILD_TAG: ${{ needs.cut.outputs.tag }}
+          RELEASE_MAC_BUILD_WORKFLOW: release-mac-build.yml
+
   publish-release:
     needs:
       - cut
       - build
       - build-mac
+      - verify-mac-build
       - skill-sharing-linux-floor-release-gate
       - skill-sharing-release-gate
       - terminal-rendering-golden
@@ -2369,6 +2414,7 @@ jobs:
       needs.cut.result == 'success' &&
       needs.build.result == 'success' &&
       needs.build-mac.result == 'success' &&
+      needs.verify-mac-build.result == 'success' &&
       needs.skill-sharing-linux-floor-release-gate.result == 'success' &&
       needs.skill-sharing-release-gate.result == 'success' &&
       needs.terminal-rendering-golden.result == 'success'

.github/workflows/zcode-account-contract.yml

@@ -1,11 +1,5 @@
 name: ZCode read-only account contract
 on:
-  pull_request:
-    paths:
-      - 'src/main/zcode/**'
-      - 'src/shared/node-bounded-file-reader*'
-      - 'src/main/rate-limits/**'
-      - '.github/workflows/zcode-account-contract.yml'
   workflow_dispatch:
 permissions:
   contents: read
@@ -13,24 +7,7 @@ concurrency:
   group: zcode-account-contract-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 jobs:
-  credential-files:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-22.04, macos-15, windows-2022]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 20
-    env:
-      ORCA_BACKGROUND_LAUNCH: '1'
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/install-node-dependencies
-        with:
-          native-runtime: node
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version-file: config/.bun-version
-      - name: Verify read-only credentials and account changes
-        run: pnpm test src/main/zcode/zcode-v2-plan-credentials.test.ts src/main/zcode/zcode-v2-personal-overlay-raw-json.test.ts src/main/rate-limits/service-zcode-usage.test.ts src/shared/node-bounded-file-reader-sync.test.ts
+  account-contract:
+    uses: ./.github/workflows/zcode-credential-contract.yml
+    with:
+      contract: account

.github/workflows/zcode-credential-contract.yml

@@ -3,18 +3,29 @@ on:
   pull_request:
     paths:
       - 'src/main/zcode/**'
+      - 'src/shared/node-bounded-file-reader*'
+      - 'src/main/rate-limits/**'
       - 'src/shared/secure-file*'
       - 'src/shared/secure-path-windows-acl*'
       - 'src/shared/windows-security-descriptor*'
+      - '.github/workflows/zcode-account-contract.yml'
       - '.github/workflows/zcode-credential-contract.yml'
+      - 'config/scripts/zcode-credential-workflow.test.mjs'
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      contract:
+        description: Keep the account workflow's manual entry point on its original test group.
+        type: string
+        default: credentials
 permissions:
   contents: read
 concurrency:
-  group: coding-plan-contract-${{ github.event.pull_request.number || github.ref }}
+  group: coding-plan-contract-${{ github.event.pull_request.number || github.ref }}-${{ inputs.contract || 'credentials' }}
   cancel-in-progress: true
 jobs:
   credential-files:
+    name: ZCode credentials (${{ matrix.os }})
     strategy:
       fail-fast: false
       matrix:
@@ -26,12 +37,57 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
+          fetch-depth: 2
           persist-credentials: false
+      - name: Select credential test groups
+        id: scope
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          MANUAL_ACCOUNT: ${{ inputs.contract == 'account' }}
+          MANUAL_CREDENTIALS: ${{ inputs.contract != 'account' }}
+        run: |
+          if [ "$EVENT_NAME" != pull_request ]; then
+            echo "account=$MANUAL_ACCOUNT" >> "$GITHUB_OUTPUT"
+            echo "credentials=$MANUAL_CREDENTIALS" >> "$GITHUB_OUTPUT"
+          else
+            account=true
+            credentials=true
+            diff_status=2
+            if git rev-parse --verify HEAD^1 >/dev/null 2>&1; then
+              diff_status=0
+              git diff --quiet --no-renames HEAD^1 HEAD || diff_status=$?
+            fi
+            if [ "$diff_status" = 1 ]; then
+              if git diff --quiet --no-renames HEAD^1 HEAD -- \
+                src/main/zcode/ ':(glob)src/shared/node-bounded-file-reader*' src/main/rate-limits/ \
+                .github/workflows/zcode-account-contract.yml \
+                .github/workflows/zcode-credential-contract.yml \
+                config/scripts/zcode-credential-workflow.test.mjs; then
+                account=false
+              fi
+              if git diff --quiet --no-renames HEAD^1 HEAD -- \
+                src/main/zcode/ ':(glob)src/shared/secure-file*' ':(glob)src/shared/secure-path-windows-acl*' \
+                ':(glob)src/shared/windows-security-descriptor*' \
+                .github/workflows/zcode-credential-contract.yml \
+                config/scripts/zcode-credential-workflow.test.mjs; then
+                credentials=false
+              fi
+            fi
+            echo "account=$account" >> "$GITHUB_OUTPUT"
+            echo "credentials=$credentials" >> "$GITHUB_OUTPUT"
+          fi
       - uses: ./.github/actions/install-node-dependencies
+        id: dependencies
         with:
           native-runtime: node
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        id: bun
         with:
           bun-version-file: config/.bun-version
+      - name: Verify read-only credentials and account changes
+        if: ${{ !cancelled() && steps.scope.outputs.account == 'true' && steps.dependencies.outcome == 'success' && steps.bun.outcome == 'success' }}
+        run: pnpm test src/main/zcode/zcode-v2-plan-credentials.test.ts src/main/zcode/zcode-v2-personal-overlay-raw-json.test.ts src/main/rate-limits/service-zcode-usage.test.ts src/shared/node-bounded-file-reader-sync.test.ts
       - name: Verify rollback and native Windows permissions
+        if: ${{ !cancelled() && steps.scope.outputs.credentials == 'true' && steps.dependencies.outcome == 'success' && steps.bun.outcome == 'success' }}
         run: pnpm test src/main/zcode/zcode-plan-api-key-store.test.ts src/main/zcode/zcode-plan-api-key-store-plaintext-rollback.test.ts src/main/zcode/zcode-plan-api-key-store-publication-race.test.ts src/main/zcode/zcode-plan-api-key-store-native-windows.test.ts src/shared/secure-file.test.ts