forge-workflow 0.1.0-beta.7 → 0.1.0-beta.8

package/lib/workflow-templates/test.yml

@@ -0,0 +1,654 @@
+name: Tests
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'bin/**'
+      - 'lib/**'
+      - 'scripts/**'
+      - 'test/**'
+      - 'test-env/**'
+      - 'skills/**'
+      - 'packages/**'
+      - 'package.json'
+      - 'bunfig.toml'
+      - '.github/workflows/**'
+      - '.github/agentic-workflows/**'
+  pull_request:
+    paths:
+      - 'bin/**'
+      - 'lib/**'
+      - 'scripts/**'
+      - 'test/**'
+      - 'test-env/**'
+      - 'skills/**'
+      - 'packages/**'
+      - 'package.json'
+      - 'bunfig.toml'
+      - '.github/workflows/**'
+      - '.github/agentic-workflows/**'
+  merge_group:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 3 * * 0'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tests-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    # Classifies the PR diff so the expensive 3-OS x 2-Node Full Matrix only runs
+    # when the change can plausibly behave differently per operating system.
+    # Anything that is not a pull_request (push to master, merge_group, schedule,
+    # workflow_dispatch) is always treated as OS-sensitive.
+    name: Classify Changed Paths
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      os_sensitive: ${{ steps.filter.outputs.os_sensitive }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Classify diff
+        id: filter
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          set -uo pipefail
+          if [ "$EVENT_NAME" != "pull_request" ]; then
+            echo "Non-PR event ($EVENT_NAME): full matrix always runs."
+            echo "os_sensitive=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if ! changed="$(git diff --name-only "$BASE_SHA...$HEAD_SHA")"; then
+            echo "::warning::Could not resolve the PR diff; failing safe to the full matrix."
+            echo "os_sensitive=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # Surfaces where Windows/macOS genuinely diverge from Linux:
+          # process/CLI entry points, native + packaged deps, filesystem/path/symlink
+          # helpers, git-hook + installer plumbing, the SQLite kernel (Windows file
+          # handle/EBUSY history), and this workflow itself.
+          os_sensitive_pattern='^(bin/|packages/|test-env/|plugin/hooks/|lib/core/|lib/kernel/|lib/activation/|lib/preflight/|lib/commands/(worktree|setup|init|install)|lib/(shell-utils|symlink-utils|file-utils|file-hash|package-root|forge-lock|detect-worktree|protected-path-manifest|hook-global-installer|hook-renderer|lefthook-check|lefthook-wiring|husky-migration|setup|setup-utils|reset)\.js$|install\.sh$|scripts/install\.|lefthook\.yml$|bunfig\.toml$|package\.json$|bun\.lock$|\.github/workflows/test\.yml$)'
+          echo "Changed files:"
+          printf '%s\n' "$changed"
+          if printf '%s\n' "$changed" | grep -Eq "$os_sensitive_pattern"; then
+            echo "OS-sensitive paths changed: running the full matrix."
+            echo "os_sensitive=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No OS-sensitive paths changed: full matrix skipped on this PR."
+            echo "Cross-OS coverage on this PR still comes from Windows Smoke, macOS Smoke"
+            echo "and the windows-node22 Targeted PR Tests lane; the full matrix re-runs on"
+            echo "merge_group, on every push to master, and on the weekly schedule."
+            echo "os_sensitive=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  full-matrix:
+    name: Full Matrix (${{ matrix.os }} / Node ${{ matrix.node-version }})
+    needs: [changes]
+    if: ${{ needs.changes.outputs.os_sensitive == 'true' }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node-version: [22, 24]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: __BUN_VERSION__
+      - name: Install dependencies
+        run: bun install
+      - name: Ensure test-results directory
+        run: |
+          node -e "require('node:fs').mkdirSync('test-results', { recursive: true })"
+      - name: Setup test fixtures (Unix)
+        if: runner.os != 'Windows'
+        run: bash test-env/automation/setup-fixtures.sh --force
+      - name: Setup test fixtures (Windows)
+        if: runner.os == 'Windows'
+        shell: bash
+        run: bash test-env/automation/setup-fixtures.sh --force
+      - name: Run matrix full suite
+        run: node scripts/test-full-suite.js --timeout 15000 --label-prefix full-matrix-${{ matrix.os }}-node${{ matrix.node-version }}
+      - name: Upload matrix artifacts
+        uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: test-artifacts-full-matrix-${{ matrix.os }}-node${{ matrix.node-version }}
+          path: test-results/
+          retention-days: 7
+
+  unit-shard:
+    name: Unit Shard ${{ matrix.shard-index }}
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        shard-index: [0, 1, 2, 3]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: __BUN_VERSION__
+      - name: Install dependencies
+        run: bun install
+      - name: Ensure test-results directory
+        run: |
+          node -e "require('node:fs').mkdirSync('test-results', { recursive: true })"
+      - name: Setup test fixtures
+        run: bash test-env/automation/setup-fixtures.sh --force
+      - name: Run unit shard
+        run: bun run test:ci:shard -- --mode shard --shard-index ${{ matrix.shard-index }} --shard-total 4 --label unit-shard-${{ matrix.shard-index }}
+      - name: Build unit shard profile
+        run: node scripts/test-profile.js --input-dir test-results --output test-results/unit-shard-${{ matrix.shard-index }}.profile.json --label unit-shard-${{ matrix.shard-index }} --integration-skipped true
+      - name: Publish unit shard summary
+        if: always()
+        shell: bash
+        run: |
+          dashboard_json="$(node scripts/test-dashboard.js --json --profiles-dir test-results)"
+          node -e "const d = JSON.parse(process.argv[1]); const lines = ['## Unit Shard Summary', '', 'Suite duration: ' + d.suiteDurationMs + 'ms', 'Integration skipped: ' + (d.integrationSkipped ? 'yes' : 'no')]; if (d.slowestFiles.length) { lines.push('', 'Slowest files:'); for (const entry of d.slowestFiles.slice(0, 5)) lines.push('- ' + entry.file + ': ' + entry.durationMs + 'ms'); } console.log(lines.join('\n'));" "$dashboard_json" >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload unit shard artifacts
+        uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: test-artifacts-unit-shard-${{ matrix.shard-index }}
+          path: test-results/
+          retention-days: 7
+
+  windows-smoke:
+    name: Windows Smoke
+    if: github.event_name == 'pull_request'
+    runs-on: windows-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: __BUN_VERSION__
+      - name: Install dependencies
+        run: bun install
+      - name: Ensure test-results directory
+        run: |
+          node -e "require('node:fs').mkdirSync('test-results', { recursive: true })"
+      - name: Run Windows smoke tests
+        run: bun run test:ci:shard -- --mode smoke --label windows-smoke
+      - name: Build Windows smoke profile
+        run: node scripts/test-profile.js --input-dir test-results --output test-results/windows-smoke.profile.json --label windows-smoke --integration-skipped true
+      - name: Publish Windows smoke summary
+        if: always()
+        shell: bash
+        run: |
+          dashboard_json="$(node scripts/test-dashboard.js --json --profiles-dir test-results)"
+          node -e "const d = JSON.parse(process.argv[1]); console.log(['## Windows Smoke Summary', '', 'Suite duration: ' + d.suiteDurationMs + 'ms'].join('\n'));" "$dashboard_json" >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload Windows smoke artifacts
+        uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: test-artifacts-windows-smoke
+          path: test-results/
+          retention-days: 7
+
+  macos-smoke:
+    name: macOS Smoke
+    if: github.event_name == 'pull_request'
+    runs-on: macos-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: __BUN_VERSION__
+      - name: Install dependencies
+        run: bun install
+      - name: Ensure test-results directory
+        run: |
+          node -e "require('node:fs').mkdirSync('test-results', { recursive: true })"
+      - name: Run macOS smoke tests
+        run: bun run test:ci:shard -- --mode smoke --label macos-smoke
+      - name: Build macOS smoke profile
+        run: node scripts/test-profile.js --input-dir test-results --output test-results/macos-smoke.profile.json --label macos-smoke --integration-skipped true
+      - name: Publish macOS smoke summary
+        if: always()
+        shell: bash
+        run: |
+          dashboard_json="$(node scripts/test-dashboard.js --json --profiles-dir test-results)"
+          node -e "const d = JSON.parse(process.argv[1]); console.log(['## macOS Smoke Summary', '', 'Suite duration: ' + d.suiteDurationMs + 'ms'].join('\n'));" "$dashboard_json" >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload macOS smoke artifacts
+        uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: test-artifacts-macos-smoke
+          path: test-results/
+          retention-days: 7
+
+  cross-os-gate:
+    # Stable, single required status check that enforces the cross-OS smoke lanes.
+    # Runs even when a smoke lane fails (if: always) and fails the PR unless BOTH
+    # Windows and macOS smoke succeeded (or were legitimately skipped). This is the
+    # context to mark Required in branch protection so a red Windows/macOS run
+    # cannot merge. For doc-only PRs the real smoke lanes are path-filtered out and
+    # the Cross-OS Gate no-op in required-checks-bypass.yml satisfies the check.
+    name: Cross-OS Gate
+    if: ${{ always() && github.event_name == 'pull_request' }}
+    needs: [windows-smoke, macos-smoke]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Require Windows + macOS smoke to pass
+        run: |
+          w='${{ needs.windows-smoke.result }}'
+          m='${{ needs.macos-smoke.result }}'
+          echo "windows-smoke=$w  macos-smoke=$m"
+          for r in "$w" "$m"; do
+            if [ "$r" = "failure" ] || [ "$r" = "cancelled" ]; then
+              echo "::error::Cross-OS smoke did not pass (windows=$w macos=$m)"
+              exit 1
+            fi
+          done
+          echo "Cross-OS smoke OK (success or skipped on both)."
+
+  followup-tests:
+    name: Targeted PR Tests (${{ matrix.label }})
+    if: github.event_name == 'pull_request'
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            node-version: 24
+            label: ubuntu-node24
+          - os: windows-latest
+            node-version: 22
+            label: windows-node22
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: __BUN_VERSION__
+      - name: Install dependencies
+        run: bun install
+      - name: Ensure test-results directory
+        run: |
+          node -e "require('node:fs').mkdirSync('test-results', { recursive: true })"
+      - name: Setup test fixtures
+        run: bash test-env/automation/setup-fixtures.sh --force
+      - name: Resolve affected test targets
+        id: affected
+        shell: bash
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          node <<'EOF'
+          const { execFileSync } = require('node:child_process');
+          const { buildTestExecutionPlan } = require('./scripts/test');
+
+          const baseSha = process.env.BASE_SHA;
+          const headSha = process.env.HEAD_SHA;
+          const outputPath = process.env.GITHUB_OUTPUT;
+          const diffOutput = execFileSync('git', ['diff', '--name-only', `${baseSha}...${headSha}`], {
+            encoding: 'utf8',
+          });
+
+          const execStub = (cmd, args, options = {}) => {
+            if (cmd === 'git' && args[0] === 'rev-parse' && args.includes('@{upstream}')) {
+              return 'origin/pull-request';
+            }
+            if (cmd === 'git' && args[0] === 'diff') {
+              return diffOutput;
+            }
+            return execFileSync(cmd, args, { ...options, encoding: 'utf8' });
+          };
+
+          const plan = buildTestExecutionPlan(process.cwd(), execStub, { sinceUpstream: true });
+          const effectiveMode = plan.mode === 'targeted' && plan.testTargets.length === 0
+            ? 'full'
+            : plan.mode;
+          const lines = [
+            `mode=${effectiveMode}`,
+            `reason=${plan.reason}`,
+            `run_test_env=${plan.runTestEnv}`,
+            `run_e2e=${plan.runE2E}`,
+            `run_workflow_tests=${plan.runWorkflowTests}`,
+          ];
+
+          if (plan.testTargets.length > 0) {
+            lines.push('targets<<EOF');
+            lines.push(...plan.testTargets);
+            lines.push('EOF');
+          }
+
+          require('node:fs').appendFileSync(outputPath, `${lines.join('\n')}\n`);
+          EOF
+      - name: Run targeted unit tests
+        if: steps.affected.outputs.mode == 'targeted'
+        shell: bash
+        run: |
+          mapfile -t test_targets <<'EOF'
+          ${{ steps.affected.outputs.targets }}
+          EOF
+          bun test --timeout 15000 "${test_targets[@]}" --reporter=junit --reporter-outfile test-results/followup-targeted.xml
+      # Route the full-suite case through the same lane-aware, worker-budgeted
+      # runner the full matrix uses. A raw `bun test test/` runs every
+      # subprocess-heavy file inside one long-lived bun process with no
+      # resource-lane separation, which is where the Windows lane's spawns start
+      # failing outright.
+      - name: Run single-platform unit suite fallback
+        if: steps.affected.outputs.mode == 'full'
+        run: node scripts/test-full-suite.js --timeout 15000 --label-prefix followup-full-${{ matrix.label }}
+      - name: Run affected e2e tests
+        if: steps.affected.outputs.run_e2e == 'true'
+        run: bun test --timeout 15000 test/e2e/ --reporter=junit --reporter-outfile test-results/followup-e2e.xml
+      - name: Run affected edge-case tests
+        if: steps.affected.outputs.run_test_env == 'true'
+        run: bun test --timeout 15000 test-env/
+      - name: Build followup profile
+        run: node scripts/test-profile.js --input-dir test-results --output test-results/followup-${{ matrix.label }}.profile.json --label followup-${{ matrix.label }} --integration-skipped true
+      - name: Publish followup summary
+        if: always()
+        shell: bash
+        run: |
+          dashboard_json="$(node scripts/test-dashboard.js --json --profiles-dir test-results)"
+          node -e "const d = JSON.parse(process.argv[1]); const lines = ['## Follow-up Test Summary', '', 'Suite duration: ' + d.suiteDurationMs + 'ms']; if (d.slowestFiles.length) { lines.push('', 'Slowest files:'); for (const entry of d.slowestFiles.slice(0, 5)) lines.push('- ' + entry.file + ': ' + entry.durationMs + 'ms'); } console.log(lines.join('\n'));" "$dashboard_json" >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload followup artifacts
+        uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: test-artifacts-followup-${{ matrix.label }}
+          path: test-results/
+          retention-days: 7
+
+  coverage:
+    name: Code Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: __BUN_VERSION__
+      - name: Install dependencies
+        run: bun install
+      - name: Ensure test-results directory
+        run: |
+          node -e "require('node:fs').mkdirSync('test-results', { recursive: true })"
+      - name: Setup test fixtures
+        run: bash test-env/automation/setup-fixtures.sh --force
+      - name: Run tests with coverage
+        run: bun test --timeout 15000 --coverage test/ --reporter=junit --reporter-outfile test-results/coverage.xml
+      - name: Build coverage profile
+        run: node scripts/test-profile.js --input-dir test-results --output test-results/coverage.profile.json --label coverage --integration-skipped true
+      - name: Publish coverage runtime summary
+        if: always()
+        shell: bash
+        run: |
+          dashboard_json="$(node scripts/test-dashboard.js --json --profiles-dir test-results)"
+          node -e "const d = JSON.parse(process.argv[1]); const lines = ['## Coverage Runtime Summary', '', 'Suite duration: ' + d.suiteDurationMs + 'ms']; if (d.slowestFiles.length) { lines.push('', 'Slowest files:'); for (const entry of d.slowestFiles.slice(0, 5)) lines.push('- ' + entry.file + ': ' + entry.durationMs + 'ms'); } console.log(lines.join('\n'));" "$dashboard_json" >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload coverage artifacts
+        uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: test-artifacts-coverage
+          path: |
+            coverage/
+            test-results/
+          retention-days: 7
+      - name: Coverage summary
+        if: always()
+        run: |
+          {
+            echo "## Coverage Report"
+            echo ""
+            echo "Coverage thresholds: 80% (lines, branches, functions, statements)"
+            if [ -f "coverage/coverage-summary.json" ]; then
+              echo "Coverage report generated"
+            else
+              echo "Coverage report not found"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  e2e:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: __BUN_VERSION__
+      - name: Install dependencies
+        run: bun install
+      - name: Ensure test-results directory
+        run: |
+          node -e "require('node:fs').mkdirSync('test-results', { recursive: true })"
+      - name: Run E2E tests
+        run: bun test --timeout 15000 test/e2e/ --reporter=junit --reporter-outfile test-results/e2e.xml
+      - name: Build E2E profile
+        run: node scripts/test-profile.js --input-dir test-results --output test-results/e2e.profile.json --label e2e --integration-skipped true
+      - name: Publish E2E runtime summary
+        if: always()
+        shell: bash
+        run: |
+          dashboard_json="$(node scripts/test-dashboard.js --json --profiles-dir test-results)"
+          node -e "const d = JSON.parse(process.argv[1]); const lines = ['## E2E Runtime Summary', '', 'Suite duration: ' + d.suiteDurationMs + 'ms']; if (d.slowestFiles.length) { lines.push('', 'Slowest files:'); for (const entry of d.slowestFiles.slice(0, 5)) lines.push('- ' + entry.file + ': ' + entry.durationMs + 'ms'); } console.log(lines.join('\n'));" "$dashboard_json" >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload E2E artifacts
+        uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: test-artifacts-e2e
+          path: test-results/
+          retention-days: 7
+
+  mutation:
+    name: Mutation Testing
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: __BUN_VERSION__
+      - name: Install dependencies
+        run: bun install
+      - name: Setup test fixtures
+        run: bash test-env/automation/setup-fixtures.sh --force
+      - name: Run mutation testing
+        run: npx stryker run
+      - name: Upload mutation report
+        uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: mutation-report
+          path: stryker-report/
+          retention-days: 30
+
+  dashboard-pr:
+    name: Test Dashboard (PR)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    needs: [unit-shard, windows-smoke, macos-smoke, coverage, e2e]
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Download test artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: test-artifacts-*
+          path: test-results/downloaded
+          merge-multiple: true
+      - name: Generate test dashboard
+        run: node scripts/test-dashboard.js --profiles-dir test-results/downloaded
+      - name: Upload dashboard
+        uses: actions/upload-artifact@v7
+        continue-on-error: true
+        with:
+          name: test-dashboard
+          path: test-dashboard.json
+          retention-days: 7
+      - name: Dashboard summary
+        if: always()
+        run: |
+          echo "## Test Quality Dashboard" >> $GITHUB_STEP_SUMMARY
+          if [ -f test-dashboard.json ]; then
+            cat test-dashboard.json | python3 -c "import sys,json; d=json.load(sys.stdin); print(f'Tests: {d[\"testCount\"]}'); print(f'Suite duration: {d[\"suiteDurationMs\"]}ms'); print(f'Integration skipped: {d[\"integrationSkipped\"]}'); print('Slowest files:'); [print(f'- {item[\"file\"]}: {item[\"durationMs\"]}ms') for item in d.get(\"slowestFiles\", [])[:5]]" >> $GITHUB_STEP_SUMMARY 2>/dev/null || echo "Dashboard generated" >> $GITHUB_STEP_SUMMARY
+          fi
+
+  ci-gate:
+    # Single aggregate status for the whole Tests workflow. Mark THIS Required in
+    # branch protection instead of the individual lanes: it stays green when a lane
+    # is legitimately skipped by the path gate above, and red the moment any lane
+    # fails or is cancelled. Adding a lane to `needs` is all that is required to
+    # bring it under the gate.
+    name: CI Gate
+    if: ${{ always() }}
+    needs:
+      - changes
+      - full-matrix
+      - unit-shard
+      - windows-smoke
+      - macos-smoke
+      - cross-os-gate
+      - followup-tests
+      - coverage
+      - e2e
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Aggregate lane results
+        shell: bash
+        env:
+          RESULTS: |
+            changes=${{ needs.changes.result }}
+            full-matrix=${{ needs.full-matrix.result }}
+            unit-shard=${{ needs.unit-shard.result }}
+            windows-smoke=${{ needs.windows-smoke.result }}
+            macos-smoke=${{ needs.macos-smoke.result }}
+            cross-os-gate=${{ needs.cross-os-gate.result }}
+            followup-tests=${{ needs.followup-tests.result }}
+            coverage=${{ needs.coverage.result }}
+            e2e=${{ needs.e2e.result }}
+        run: |
+          set -uo pipefail
+          echo "$RESULTS"
+          failed=0
+          while IFS='=' read -r lane result; do
+            [ -n "$lane" ] || continue
+            case "$result" in
+              success|skipped) ;;
+              *) echo "::error::Lane '$lane' finished as '$result'"; failed=1 ;;
+            esac
+          done <<< "$RESULTS"
+          if [ "$failed" -ne 0 ]; then
+            exit 1
+          fi
+          echo "All test lanes passed or were skipped by the path gate."
+
+  dashboard-confidence:
+    name: Test Dashboard (Confidence Lane)
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    needs: [full-matrix, coverage, e2e]
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Download test artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: test-artifacts-*
+          path: test-results/downloaded
+          merge-multiple: true
+      - name: Generate test dashboard
+        run: node scripts/test-dashboard.js --profiles-dir test-results/downloaded
+      - name: Upload dashboard
+        uses: actions/upload-artifact@v7
+        continue-on-error: true
+        with:
+          name: test-dashboard
+          path: test-dashboard.json
+          retention-days: 7
+      - name: Dashboard summary
+        if: always()
+        run: |
+          echo "## Test Quality Dashboard" >> $GITHUB_STEP_SUMMARY
+          if [ -f test-dashboard.json ]; then
+            cat test-dashboard.json | python3 -c "import sys,json; d=json.load(sys.stdin); print(f'Tests: {d[\"testCount\"]}'); print(f'Suite duration: {d[\"suiteDurationMs\"]}ms'); print(f'Integration skipped: {d[\"integrationSkipped\"]}'); print('Slowest files:'); [print(f'- {item[\"file\"]}: {item[\"durationMs\"]}ms') for item in d.get(\"slowestFiles\", [])[:5]]" >> $GITHUB_STEP_SUMMARY 2>/dev/null || echo "Dashboard generated" >> $GITHUB_STEP_SUMMARY
+          fi