orca/.github/workflows/unit-selection-evidence.yml

name: Unit selection evidence

# Why its own workflow: this job is advisory -- `continue-on-error` on both the job and its
# comparison step, so it can never fail a PR. But a caller's `needs: test` waits for every job in
# the called workflow, so while it lived in unit-tests.yml it held `verify` for ~36s after the
# last shard finished. Called as a sibling instead, it still runs on every PR and still uploads
# its review artifact; it just no longer sits on the critical path.
on:
  workflow_call:

permissions:
  contents: read

jobs:
  selection_evidence:
    if: ${{ !cancelled() }}
    continue-on-error: true
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@v6
        with:
          sparse-checkout: config/scripts/ci-unit-selection-review.mjs
          sparse-checkout-cone-mode: false
          persist-credentials: false
      - uses: actions/download-artifact@v8
        with:
          pattern: unit-shard-node-*-attempt-${{ github.run_attempt }}
          path: unit-evidence/
      - name: Compare selection with full results
        continue-on-error: true
        uses: actions/github-script@v8
        with:
          github-token: unused
          script: |
            const env = { ...process.env }
            delete env['INPUT_GITHUB-TOKEN']
            await exec.exec(process.execPath, [
              'config/scripts/ci-unit-selection-review.mjs',
              'unit-evidence'
            ], { env })
      - uses: actions/upload-artifact@v7
        if: always()
        continue-on-error: true
        with:
          name: unit-selection-review-attempt-${{ github.run_attempt }}
          path: unit-evidence/selection-review.json
          retention-days: 30