CI: keep one-OS dispatches off ci-ok

A dispatch that ran only one OS still reported `ci-ok`, the required
check, on the branch head, so a Windows-only run could make a PR whose
Linux jobs failed look green. Such a run now reports as `ci-ok (<os>
only)`; every other run still reports `ci-ok`.

Dispatches for different OSes on one branch also shared a concurrency
group, so a third dispatch replaced the pending second one. Each
OS-filtered dispatch now gets its own group.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

.github/workflows/ci.yml

@@ -33,9 +33,12 @@ on:
         # Run only one OS's jobs (plus the clippy and release-readiness
         # preflights every leg waits on). A fix for a Windows-only nightly
         # failure dispatches `-f os=windows` instead of re-running ~95 Linux
-        # and macOS jobs its PR run and the merge queue already cover. Only
-        # a dispatch sets inputs.os; on every other event it is empty, so
-        # the `inputs.os != ...` terms below are always true there.
+        # and macOS jobs (~140 job-minutes) its PR run and the merge queue
+        # already cover. hosted-e2e is a Linux job and skips too. Only a
+        # dispatch sets inputs.os; on every other event it is empty, so the
+        # `inputs.os != ...` terms below are always true there. Each
+        # OS-filtered dispatch gets its own concurrency group, so
+        # dispatching one per OS runs them all.
         description: 'Only run jobs for this OS (all = the full nightly matrix)'
         type: choice
         default: all
@@ -56,7 +59,7 @@ permissions:
 # cancelled the real run, skipped every job, and left ci-ok green on a head
 # nothing had tested.
 concurrency:
-  group: ci-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}${{ github.event_name == 'schedule' && '-nightly' || '' }}${{ github.event.pull_request.draft && '-draft' || '' }}
+  group: ci-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}${{ github.event_name == 'schedule' && '-nightly' || '' }}${{ github.event.pull_request.draft && '-draft' || '' }}${{ inputs.os && inputs.os != 'all' && format('-{0}', inputs.os) || '' }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 # Linux jobs run on Depot's runners (depot-ubuntu-*-4: 4 vCPU, like GitHub's
@@ -2895,7 +2898,11 @@ jobs:
   # every job above, so adding a job here is how it becomes merge-blocking.
   # Skipped jobs (the nightly `full` tier) pass; failed or cancelled ones fail.
   ci-ok:
-    name: ci-ok                 # registered as a required check; do not rename
+    # Registered as a required check; do not rename. A one-OS dispatch
+    # (inputs.os, #1818) skips the other OSes, so its verdict gets another
+    # name: a green `ci-ok` on the branch head must mean every PR-tier job
+    # passed, and a skipped required check would count as passing too.
+    name: ${{ inputs.os && inputs.os != 'all' && format('ci-ok ({0} only)', inputs.os) || 'ci-ok' }}
     if: always()
     needs: [clippy, node-addon, lint-ecosystems, release-readiness, test, test-release, coverage, docker-base, coverage-docker, coverage-merge, dispatch-tests, e2e-build, windows-compile-check, e2e-build-windows, e2e-build-macos, e2e, e2e-windows, e2e-extended, e2e-full, e2e-docker, yarn-classic-matrix, yarn-berry-e2e, yarn-berry-full, cargo-vex-matrix, cargo-vex-matrix-windows, cargo-vex-matrix-full, cargo-old-toolchains, hosted-e2e, e2e-macos, yarn-berry-e2e-macos, cargo-vex-matrix-macos]
     # GitHub-hosted, not Depot: the check is one 2 s python3 call that runs

scripts/tests/test_ci_e2e_tiers.py

@@ -77,13 +77,15 @@ def test_full_jobs_run_nightly_only_and_share_steps(self):
                 # Nightly, dispatch (release-qa) and v5 landings, like
                 # e2e-docker: not on PRs, the merge queue or a lean push to
                 # main, where its 41 legs ran on every landing.
-                # A job with no OS-gated ancestor carries the Linux-only
-                # term for `workflow_dispatch -f os=...` (#1818).
-                gate = ("github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'"
+                # yarn-berry-full waits only on clippy, so it carries the
+                # Linux-only term for `workflow_dispatch -f os=...` itself
+                # (#1818); the others skip with e2e-build.
+                gate = ("    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'"
                         " || (github.event_name == 'push' && vars.CI_SCOPE == 'full')"
                         " || github.head_ref == 'release/v5-prerelease'")
-                self.assertTrue(f"    if: {gate}\n" in text or f"    if: ({gate}) && (inputs.os != 'windows'"
-                                " && inputs.os != 'macos')\n" in text, text)
+                if job == "yarn-berry-full":
+                    gate = gate.replace("    if: ", "    if: (") + ") && (inputs.os != 'windows' && inputs.os != 'macos')"
+                self.assertIn(gate + "\n", text)
                 self.assertIn(f"steps: *{anchor}", text)
                 self.assertIn(f"steps: &{anchor}", TEXT)
 

scripts/tests/test_ci_scheduling.py

@@ -298,6 +298,15 @@ def test_late_draft_run_cannot_cancel_the_ready_run(self):
         # ci-ok green with every job skipped.
         group = re.search(r"^concurrency:\n  group: (.*)$", TEXT, re.M)[1]
         self.assertIn("github.event.pull_request.draft && '-draft'", group)
+        # One dispatch per OS must not cancel the pending one before it.
+        self.assertIn("${{ inputs.os && inputs.os != 'all' && format('-{0}', inputs.os) || '' }}", group)
+
+    def test_one_os_dispatch_cannot_post_a_green_ci_ok(self):
+        # A dispatch on a PR head that skipped the other OSes must not report
+        # under the required check's name (#1818); every other event does.
+        names = [line for line in JOBS["ci-ok"] if line.startswith("    name:")]
+        self.assertEqual(names, ["    name: ${{ inputs.os && inputs.os != 'all'"
+                                 " && format('ci-ok ({0} only)', inputs.os) || 'ci-ok' }}"])
 
     def test_row_reader_preserves_both_os_siblings(self):
         jobs = reader.jobs("""jobs: