ci: affected on PRs, full sweep on main+nightly, fold pgtest into gate

[mattwilkinsonn]

What

Four changes to the CI pipeline:

1. Affected on PRs (.github/workflows/ci.yml). Pull requests now run moon ci :ci (affected-only) instead of the unconditional moon run :ci. A Go, UI, or docs PR no longer pays for the vendored forks' nix builds — the dominant cost, and the reason the gate job's timeout is 90m. moon reads the PR's base from GITHUB_BASE_REF and runs only the projects the change affects.
2. Full sweep on everything that reaches main. Every push to main and a nightly schedule (cron 17 7 * * *) run the full moon run :ci — every task, every project, no filter. This is the backstop that makes affected safe: an incomplete inputs glob that let a task be skipped on a PR is caught the moment the change lands on main (named and attributable), and re-checked nightly.
3. Per-task log grouping. Adds appthrust/moon-ci-retrospect (pinned by SHA, v2.1.0) to collapse the single job's flat task fan-out into per-task sections in the Actions log. No token, no added permissions — permissions: contents: read is untouched. The SHA pin is its fork-PR trust anchor (documented in-file, alongside the pgtest-digest and nix-key precedents).
4. pgtest folded into the gate job. The real-Postgres suites, previously a standalone pgtest job, now run as a step in gate against a Postgres service container attached to the job. One required check instead of two. Trades the blast-radius isolation (a service-container flake now reds gate) for a single context to require in branch protection — a deliberate call. The suites still run unconditionally (no affected filter, no event filter), and the skip-assertion guard moves with them, so a service that never came up still fails loudly rather than passing silently.

Supporting changes: go/moon.yml adds go.work/go.work.sum (both project-relative and repo-root globs) to the Go lane's go_sources and lint inputs so a future workspace file invalidates the Go battery (closes a latent affected-skip gap; no go.work exists today). docs/architecture/build-and-ci.md's ## CI section is rewritten to describe the affected-on-PR / full-on-main+nightly model and the folded pgtest.

Why affected-on-PR / full-on-main

The pipeline is now a single job (gate), and fail-closed against silent skips. moon ci's affected detection reintroduces inputs-completeness as a correctness dependency, so it is confined to the PR fast path; main is never gated by affected. On a push to main GITHUB_BASE_REF is unset, so moon ci would diff main against its own tip (empty, a misleading green) — hence the full moon run :ci there.

Why fold pgtest into gate

pgtest was split out so a Postgres-service outage couldn't red the hermetic gate. But it also meant two required checks to pin in branch protection. Folding it in makes gate the single check that certifies both the moon battery and the real-Postgres suites — one context to require, one place to look. The accepted cost: a Postgres-container flake now reds gate (a re-run clears it), rather than reddening only an advisory second check.

Verification

• Affected detection smoke-tested against a clean origin/main worktree: Go change surfaces compass-go+compass-proto, UI → compass-ui+compass-client, docs → root sweeps only, proto → compass-proto+compass-client. Forks build only when forks/ is touched. A scratch go/go.work now correctly marks compass-go:ci affected after the inputs fix.
• This PR's own gate proves the affected win: earlier heads' gate ran in ~1m11s (affected: only toolchain-parity:ci for a ci.yml-only change) vs the 90m full-battery budget. The fold adds the real-Postgres suites back onto every gate run (the Postgres service + -tags pgtest step), so the head carrying the fold runs pgtest inside gate.
• Fold preserves pgtest behavior: the go test … >log || rc=$?; cat log; exit $rc capture (not | tee, which once swallowed a FAIL), CGO_ENABLED=1, -race, -timeout 15m, the DSN env, the digest-pinned postgres:16-alpine image matching pgtest.go's pgImage, and the source-derived skip-assertion all move intact. Standalone pgtest job fully removed (no dangling needs:).
• actionlint clean on the additions (the one remaining SC1087 is pre-existing in the pgtest assertion script, a false positive on a [[:space:]] regex, which moved with the step). markdownlint clean on the doc.
• Concurrency key gains ${{ github.event_name }} so a nightly run and a coincident post-merge push don't cancel each other.

Refs SEA-1507

Co-Authored-By: seal noreply@sealedsecurity.com

[linear-code]

SEA-1507

[mattwilkinsonn]

• ci: affected on PRs, full sweep on main+nightly, fold pgtest into gate #40 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

The PR optimizes pull-request CI while retaining exhaustive post-merge coverage.

• Runs affected Moon tasks for pull requests and full task sweeps on pushes to main and nightly schedules.
• Adds grouped Moon task logs and isolates scheduled runs in the concurrency key.
• Includes Go workspace files in Go task and lint inputs.
• Documents the affected-PR and full-sweep CI model.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Splits the gate into affected pull-request and full push/nightly paths, adds nightly scheduling, event-scoped concurrency, and grouped task logs.
docs/architecture/build-and-ci.md	Updates the architecture documentation to accurately describe affected pull-request checks and full main/nightly sweeps.
go/moon.yml	Adds project- and repository-root Go workspace files to affected detection and lint cache inputs, resolving both prior workspace findings.

_{Reviews (4): Last reviewed commit: "ci(go): cover repo-root go.work in go + ..." | Re-trigger Greptile}