ci: reduce runner occupancy in release and contract jobs (#28930)

.github/workflows/zcode-credential-contract.yml

@@ -3,18 +3,29 @@ on:
   pull_request:
     paths:
       - 'src/main/zcode/**'
+      - 'src/shared/node-bounded-file-reader*'
+      - 'src/main/rate-limits/**'
       - 'src/shared/secure-file*'
       - 'src/shared/secure-path-windows-acl*'
       - 'src/shared/windows-security-descriptor*'
+      - '.github/workflows/zcode-account-contract.yml'
       - '.github/workflows/zcode-credential-contract.yml'
+      - 'config/scripts/zcode-credential-workflow.test.mjs'
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      contract:
+        description: Keep the account workflow's manual entry point on its original test group.
+        type: string
+        default: credentials
 permissions:
   contents: read
 concurrency:
-  group: coding-plan-contract-${{ github.event.pull_request.number || github.ref }}
+  group: coding-plan-contract-${{ github.event.pull_request.number || github.ref }}-${{ inputs.contract || 'credentials' }}
   cancel-in-progress: true
 jobs:
   credential-files:
+    name: ZCode credentials (${{ matrix.os }})
     strategy:
       fail-fast: false
       matrix:
@@ -26,12 +37,57 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
+          fetch-depth: 2
           persist-credentials: false
+      - name: Select credential test groups
+        id: scope
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          MANUAL_ACCOUNT: ${{ inputs.contract == 'account' }}
+          MANUAL_CREDENTIALS: ${{ inputs.contract != 'account' }}
+        run: |
+          if [ "$EVENT_NAME" != pull_request ]; then
+            echo "account=$MANUAL_ACCOUNT" >> "$GITHUB_OUTPUT"
+            echo "credentials=$MANUAL_CREDENTIALS" >> "$GITHUB_OUTPUT"
+          else
+            account=true
+            credentials=true
+            diff_status=2
+            if git rev-parse --verify HEAD^1 >/dev/null 2>&1; then
+              diff_status=0
+              git diff --quiet --no-renames HEAD^1 HEAD || diff_status=$?
+            fi
+            if [ "$diff_status" = 1 ]; then
+              if git diff --quiet --no-renames HEAD^1 HEAD -- \
+                src/main/zcode/ ':(glob)src/shared/node-bounded-file-reader*' src/main/rate-limits/ \
+                .github/workflows/zcode-account-contract.yml \
+                .github/workflows/zcode-credential-contract.yml \
+                config/scripts/zcode-credential-workflow.test.mjs; then
+                account=false
+              fi
+              if git diff --quiet --no-renames HEAD^1 HEAD -- \
+                src/main/zcode/ ':(glob)src/shared/secure-file*' ':(glob)src/shared/secure-path-windows-acl*' \
+                ':(glob)src/shared/windows-security-descriptor*' \
+                .github/workflows/zcode-credential-contract.yml \
+                config/scripts/zcode-credential-workflow.test.mjs; then
+                credentials=false
+              fi
+            fi
+            echo "account=$account" >> "$GITHUB_OUTPUT"
+            echo "credentials=$credentials" >> "$GITHUB_OUTPUT"
+          fi
       - uses: ./.github/actions/install-node-dependencies
+        id: dependencies
         with:
           native-runtime: node
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        id: bun
         with:
           bun-version-file: config/.bun-version
+      - name: Verify read-only credentials and account changes
+        if: ${{ !cancelled() && steps.scope.outputs.account == 'true' && steps.dependencies.outcome == 'success' && steps.bun.outcome == 'success' }}
+        run: pnpm test src/main/zcode/zcode-v2-plan-credentials.test.ts src/main/zcode/zcode-v2-personal-overlay-raw-json.test.ts src/main/rate-limits/service-zcode-usage.test.ts src/shared/node-bounded-file-reader-sync.test.ts
       - name: Verify rollback and native Windows permissions
+        if: ${{ !cancelled() && steps.scope.outputs.credentials == 'true' && steps.dependencies.outcome == 'success' && steps.bun.outcome == 'success' }}
         run: pnpm test src/main/zcode/zcode-plan-api-key-store.test.ts src/main/zcode/zcode-plan-api-key-store-plaintext-rollback.test.ts src/main/zcode/zcode-plan-api-key-store-publication-race.test.ts src/main/zcode/zcode-plan-api-key-store-native-windows.test.ts src/shared/secure-file.test.ts