ci(#553): split the CI quality gates into parallel reusable workflows

[drmoisan]

Split the CI quality gates into parallel reusable workflows

Summary

• Decomposes .github/workflows/ci.yml from a 160-line file with one monolithic windows-latest job into a 32-line orchestrator that calls five reusable workflows with no inline steps: and no needs: edges, so the four quality gates run concurrently instead of serially.
• Measured wall clock drops from 444s to a median 259s (a 41.7% reduction) across four post-split samples (259s, 433s, 245s, 296s). The 444s baseline is measured, not estimated.
• Every gate run: block was transplanted byte-identically, verified by SHA-256 comparison of 14 extracted step blocks and independently re-verified during review.
• Failure isolation was proven empirically by three pushed-and-reverted probes, not asserted: each violation turned exactly one gate red while the other four reported independently.
• The main branch ruleset has already been migrated (see Backward Compatibility). Both previously required contexts were retired by this change and have been replaced with five per-gate contexts.
• Estimated billed windows-latest seconds rise from ~444 to ~764, roughly 1.7x, before GitHub's Windows 2x multiplier. This is the deliberate cost of the latency reduction.

Why

ci.yml ran the entire C# quality toolchain inside a single quality-gates job. Wall-clock latency was the sum of all stages, and the measured baseline (green run 31749877507) breaks down as:

Phase	Duration
Fixed setup (checkout, SDK, MSBuild, NuGet, caches, restore)	130s
Verify formatting	15s
Build with analyzers	101s
Build with nullable warnings as errors (/t:Rebuild)	98s
MSTest with coverage	88s
Total	444s

Two consequences beyond latency:

• No independent failure signal. All gates reported as one required check named Format, build, analyze, and test, so a red check did not identify which gate failed without opening the log.
• No independent re-dispatch. A transient failure in one stage required re-running the entire job.

What Changed

CI pipeline (7 files, +487 / -141)

File	Change
ci.yml	Rewritten as a 32-line orchestrator: on, permissions, concurrency, and five uses: jobs. No inline steps:, no needs:.
_actionlint.yml	New. ubuntu-latest, 10-minute timeout.
_format-check.yml	New. CSharpier gate. Drops setup-msbuild, setup-nuget, the packages cache, and nuget restore — CSharpier reads source text only.
_build-analyzers.yml	New. /t:Build with EnableNETAnalyzers and EnforceCodeStyleInBuild.
_build-nullable.yml	New. /t:Rebuild with TreatWarningsAsErrors, including its 7-line in-file rationale comment.
_mstest-coverage.yml	New. Plain build, then the unchanged discovery filter and vstest invocation, then the test-results upload.
README.md	New. Documents per-stage workflow_dispatch and the branch-protection rename procedure.

Each callee declares both on: workflow_call: and on: workflow_dispatch:, its own permissions: contents: read, a right-sized timeout-minutes, and no concurrency block — the caller owns the concurrency group.

Documentation and evidence

The remaining 60 files are the feature folder for issue #553: research, spec, user story, the atomic plan, review artifacts, and the evidence tree. Two files under docs/features/potential/promoted/ are unrelated archival records for issues #554 and #555 (latent defects found while doing this work) and were committed separately.

Architecture / How It Fits Together

ci.yml retains the triggers, permissions, and the workflow-level concurrency group, then fans out to five independent jobs. Because a called workflow's jobs run as part of the caller's run, the existing group continues to cover all five, and cancel-in-progress: true cancels them together when a newer run supersedes.

There are no needs: edges. Build-output sharing between jobs was evaluated and rejected: a needs: edge serializes the build job's setup and compile ahead of the test job, so it loses to a per-job rebuild on critical-path arithmetic even at zero transfer cost, and it adds .pdb/dependency-closure fragility.

The analyzer and nullable compiles were deliberately not merged. A single invocation carrying both property sets would either promote analyzer warnings to errors (an unratified strengthening) or require WarningsNotAsErrors carve-outs that risk exempting nullable diagnostics (a weakening). Either direction alters a gate, so both compiles run unchanged in separate jobs.

Verification

Completed

• Byte-identity: 14 step blocks SHA-256-compared between the pre-split ci.yml and the callees; 14/14 match, including both if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } guards, the vstest discovery filter, the zero-assembly throw, the /t:Rebuild rationale comment, and the test-results upload with if: always().

• actionlint: exit 0 over all seven workflow files, confirmed by -verbose naming each file individually.

• Green runs: multiple, including 31840944277 at the current head with all five jobs success.

• Fault isolation, empirically proven:

  Probe	Violation	Red gate	Other gates
  Format	Indentation changed in a .cs file	format-check only	all success
  Nullable	=> null; in a #nullable enable file (CS8603)	build-nullable only	all success
  MSTest	Inverted a FluentAssertions assertion	mstest-coverage only (1 of 6435 tests)	all success

  The nullable probe is the sharpest evidence of preserved gate semantics: identical source produced only a warning in the analyzer job and in the MSTest job's plain build, and an error only under the nullable gate's TreatWarningsAsErrors.

• Probe cleanliness: all three probe/revert pairs are byte-exact; the net branch diff contains zero C# or project files.

• $LASTEXITCODE hygiene: every pwsh step reviewed against .claude/rules/ci-workflows.md. None uses the deliberately-failing nested-command pattern, so no explicit reset is required.

• Review: cycle-2 feature review reports zero blocking findings and 18 of 18 acceptance criteria passing.

• No C# toolchain run. No C# or project file changed on this branch, so csharpier/msbuild/vstest were not run locally; the gates themselves exercise them in CI.

Recommended

gh workflow run _format-check.yml     --ref main
gh workflow run _build-analyzers.yml  --ref main
gh workflow run _build-nullable.yml   --ref main
gh workflow run _mstest-coverage.yml  --ref main
gh workflow run _actionlint.yml       --ref main
gh api repos/drmoisan/TaskMaster/rulesets/18572843 --jq '.rules[] | select(.type=="required_status_checks")'

Backward Compatibility / Migration Notes

The main ruleset (id 18572843) was migrated before this PR was opened, with explicit owner authorization. A reviewer should not be surprised by it.

	Before	After
Required contexts	actionlint, Format, build, analyze, and test	actionlint / actionlint, format-check / Verify formatting, build-analyzers / Build with analyzers and code style enforcement, build-nullable / Build with nullable warnings treated as errors, mstest-coverage / Run MSTest suite with coverage
strict_required_status_checks_policy	true	true (unchanged)
Rule types	4	4 (unchanged)

Both old contexts were retired by this change: the monolithic job was split, and actionlint became actionlint / actionlint when it moved into a callee, because a called workflow reports as <caller job id> / <callee job name>.

The migration was a single atomic PUT of the full writable object. Five pre-PUT checks passed, including a diff-confinement check proving the payload altered only the contexts array and could not silently drop the deletion, non_fast_forward, or pull_request rules. Post-PUT set equality was verified by an independent GET, not the PUT response body. Evidence, including the pre-PUT object, the exact payload, and the post-PUT state, is under evidence/other/ruleset-migration/.

Consequence: every other open PR against main whose head predates this change reports the old contexts and cannot report the new ones, so it is blocked until it updates its branch past this merge. This is over-blocking, never under-gating, but it means this PR should merge promptly.

Rollback: a single PUT restoring the previous contexts set reverts the merge policy; the workflow change itself reverts as an ordinary revert PR.

Risks and Mitigations

Risk	Mitigation
Billed Windows minutes rise ~1.7x because the 130s setup is paid per job	Setup was tailored per job (format drops NuGet restore; msbuild jobs drop setup-dotnet), trimming ~57s per job. Verified green on first run.
Hosted-runner variance can erode the measured gain	Four samples reported, including the unfavourable 433s outlier. Median 259s. The outlier is documented: every compute-bound step scaled ~1.6x while fixed costs stayed flat, with queueing excluded.
A context-name mismatch would leave a permanently unreportable required check	Names were captured from live runs, never assumed, and verified set-equal against the live ruleset after the PUT.
Cross-run runner contention could queue jobs	The 5-job per-run demand is below every plan's concurrent-job ceiling. Cross-run contention is not determinable from repository data.

Review Guide

Suggested order:

1. .github/workflows/ci.yml — 32 lines, the whole orchestration.
2. The five _*.yml callees — the substance. Compare against evidence/other/pre-split/ci.yml.pre-split.txt.
3. evidence/qa-gates/byte-identity.2026-08-14T09-54.md — the transplant proof.
4. evidence/regression-testing/probe-*.md — the fault-isolation proof.
5. evidence/other/ruleset-migration/ — the branch-protection change.
6. .github/workflows/README.md — operational procedures.

The remaining feature-folder documents are supporting material and can be skimmed. The 13 commits include three probe/revert pairs that cancel out; reviewing the net diff is more useful than walking commit by commit.

Follow-ups

• Plan Phase 6 checkboxes lag the executed migration; reconcile in the post-merge phase (non-blocking).
• The actionlint tarball in the _actionlint.yml step is not checksum-pinned. Pre-existing, transplanted byte-identically.
• GitHub emits a Node.js 20 deprecation warning for actions/cache@v4, actions/checkout@v4, microsoft/setup-msbuild@v2, and nuget/setup-nuget@v2. Pre-existing, not a regression from this change.
• Moving the format gate to ubuntu-latest (CSharpier is cross-platform; Linux bills at 1x) was deliberately deferred as a separate platform-parity question.
• Issues Bug: potential-to-issue-promoted-copy-not-written #554 and Bug: orchestrator-hooks-reference-absent-python-validators #555 were filed for latent defects found during this work.

GitHub Auto-close

• Closes Feature: ci-parallel-job-split #553