From 8457ddbd5ff3e485c1e9c3142340ea337e12faea Mon Sep 17 00:00:00 2001
From: Teakowa <27560638+Teakowa@users.noreply.github.com>
Date: Sat, 22 Aug 2026 19:23:43 +0800
Subject: [PATCH 1/2] ci: reorganize checks by capability, dependency, and
 reporting (#207)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the flat milestone-named CI structure with 9 capability-oriented
jobs in a dependency-aware DAG, addressing every acceptance criterion in
issue #207.

Job changes
-----------
- Remove `v1-gates` catch-all bucket; its contents are distributed:
  - N-level compatibility gate → `opy-integration`
  - Compile-time scenario runner → `scenario-validation`
  - Benchmarks → `benchmark`
- Rename `cli-github-actions-smoke` → `cli-behavior`
- Rename `lpp-client-integration` → `lpp-integration`
- Rename `ostw-compile-differential` → `del-integration`
- Rename `adapter` → `opy-adapter`
- Absorb `compatibility-differential` into `opy-integration`

DAG dependency structure
------------------------
- `paths` runs first (path filter, no external deps)
- `rust-quality` gates: depends on `paths`
- `opy-integration`, `del-integration`, `lpp-integration`, `cli-behavior`,
  `scenario-validation`, `benchmark`: depend on `paths` + `rust-quality`
- `opy-adapter`: depends only on `paths` (TypeScript, no Rust gate needed)
- `dist-validation`: depends on `paths` + `rust-quality` + `opy-integration`
  + `lpp-integration`; skipped intentionally when any upstream gate fails

PR path filters
---------------
A new `paths` job computes conservative change/dependency-aware filters:
- Broad/core changes (Cargo workspace, src/, scripts/, CI) expand all checks
- `adapter/` changes trigger `opy-adapter` only
- `dist/` changes additionally trigger `dist-validation`
- Push to `main` bypasses filters and runs all checks

GITHUB_STEP_SUMMARY
--------------------
`opy-integration`, `del-integration`, `scenario-validation`, and `benchmark`
write concise Markdown summaries derived from their JSON reports. Summaries
show PASS/FAIL state, totals, and individual failures. Upstream-blocked
`dist-validation` is explicitly explained in summary rather than silently
skipped.

Artifact uploads updated from v7 to v4 throughout.

Closes #207
---
 .github/workflows/ci.yml | 518 ++++++++++++++++++++++++++++++++-------
 1 file changed, 424 insertions(+), 94 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64c71f6..2ad3819 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,14 @@
 name: CI
 
+# ---------------------------------------------------------------------------
+# Trigger rules
+# ---------------------------------------------------------------------------
+# Push to main: full convergence run (all capability checks).
+# PR: capability checks are selected by changed paths.  Broad/core changes
+# (Cargo workspace, scripts, compatibility fixtures, CI itself) expand to the
+# full check set; narrow path changes run only the relevant capability.
+# Docs-only changes skip CI entirely.
+
 on:
   push:
     branches: ["main"]
@@ -14,9 +23,80 @@ on:
 permissions:
   contents: read
 
+# ---------------------------------------------------------------------------
+# Path filter: determines which capability jobs run on PRs.
+# On push-to-main every filter is forced to true so all jobs run.
+# ---------------------------------------------------------------------------
 jobs:
+  paths:
+    name: Detect changed paths
+    runs-on: ubuntu-latest
+    outputs:
+      rust_core: ${{ steps.f.outputs.rust_core }}
+      opy: ${{ steps.f.outputs.opy }}
+      del: ${{ steps.f.outputs.del }}
+      lpp: ${{ steps.f.outputs.lpp }}
+      cli: ${{ steps.f.outputs.cli }}
+      opy_adapter: ${{ steps.f.outputs.opy_adapter }}
+      dist: ${{ steps.f.outputs.dist }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute path filters
+        id: f
+        shell: bash
+        run: |
+          set -euo pipefail
+          # On push-to-main run everything unconditionally.
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            echo "rust_core=true"   >> "$GITHUB_OUTPUT"
+            echo "opy=true"         >> "$GITHUB_OUTPUT"
+            echo "del=true"         >> "$GITHUB_OUTPUT"
+            echo "lpp=true"         >> "$GITHUB_OUTPUT"
+            echo "cli=true"         >> "$GITHUB_OUTPUT"
+            echo "opy_adapter=true" >> "$GITHUB_OUTPUT"
+            echo "dist=true"        >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Compute files changed in this PR against the merge-base.
+          base="${{ github.event.pull_request.base.sha }}"
+          head="${{ github.event.pull_request.head.sha }}"
+          changed="$(git diff --name-only "${base}...${head}")"
+
+          # Helper: returns "true" if any path matches the given grep pattern.
+          matches() { echo "$changed" | grep -qE "$1" && echo "true" || echo "false"; }
+
+          # Core Rust workspace changes expand all Rust-based checks.
+          broad="(^Cargo\.(toml|lock)$|^(src|crates|compatibility|scenarios)/|^scripts/|^\.github/workflows/)"
+          broad_match="$(matches "$broad")"
+
+          echo "rust_core=${broad_match}"   >> "$GITHUB_OUTPUT"
+          echo "opy=${broad_match}"         >> "$GITHUB_OUTPUT"
+          echo "del=${broad_match}"         >> "$GITHUB_OUTPUT"
+          echo "lpp=${broad_match}"         >> "$GITHUB_OUTPUT"
+          echo "cli=${broad_match}"         >> "$GITHUB_OUTPUT"
+
+          # OPY adapter is TypeScript-only; only changes in adapter/ trigger it
+          # unless a broad change already forces everything.
+          opy_adapter_match="$(matches "(^adapter/|${broad})")"
+          echo "opy_adapter=${opy_adapter_match}" >> "$GITHUB_OUTPUT"
+
+          # Distribution validation additionally triggers on dist/ manifest changes.
+          dist_match="$(matches "(^dist/|${broad})")"
+          echo "dist=${dist_match}" >> "$GITHUB_OUTPUT"
+
+  # -------------------------------------------------------------------------
+  # [1] RUST QUALITY & TESTS  (fundamental gate)
+  # All other Rust-based jobs depend on this.
+  # -------------------------------------------------------------------------
   rust-quality:
     name: Rust quality (${{ matrix.toolchain }})
+    needs: paths
+    if: needs.paths.outputs.rust_core == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -27,7 +107,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -54,51 +134,179 @@ jobs:
       - name: Run tests
         run: cargo test --locked --workspace --all-targets --all-features
 
-  cli-github-actions-smoke:
-    name: Wright CLI GitHub Actions smoke
+  # -------------------------------------------------------------------------
+  # [2] OPY INTEGRATION  (Wright's consumer contract with OverPy/OPY)
+  # Covers:
+  #   - Committed compatibility evidence integrity (no live oracle needed)
+  #   - N-level gate: Wright compile vs recorded reference snapshots
+  #   - Native-vs-reference differential suite (opy-rs ownership consumption)
+  # -------------------------------------------------------------------------
+  opy-integration:
+    name: OPY integration (N-level + differential)
+    needs: [paths, rust-quality]
+    if: needs.paths.outputs.opy == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
         with:
           toolchain: stable
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: linux-quality
+          cache-targets: true
+          cache-all-crates: false
+          cache-workspace-crates: false
+          cache-bin: false
+          save-if: false
+          cache-on-failure: false
 
-      - name: Build wright CLI
+      - name: Build wright (debug)
         run: cargo build --locked -p wright-cli
 
-      - name: Exercise auto GitHub Actions renderer
+      - name: Validate committed compatibility evidence
+        run: python3 -m unittest discover -s compatibility/tests
+
+      - name: Run N-level gate (Wright compile vs recorded snapshots)
+        id: n_level
+        run: python3 scripts/v1-gates.py
+
+      - name: Run native-vs-reference differential suite
+        id: differential
+        if: always()
+        run: cargo test --locked -p wright-opy --test differential
+
+      - name: Upload OPY integration reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: opy-integration-reports
+          path: |
+            target/v1-gates-report.json
+            target/wright-differential-report.json
+
+      - name: Write step summary
+        if: always()
         shell: bash
         run: |
           set -euo pipefail
-          fixture="$RUNNER_TEMP/wright-gha-smoke.ws"
-          stdout="$RUNNER_TEMP/wright-gha-smoke.stdout"
-          stderr="$RUNNER_TEMP/wright-gha-smoke.stderr"
-          cat > "$fixture" <<'EOF'
-          rule ("gha smoke") {
-              event {
-                  Ongoing - Global;
-              }
-              actions {
-                  Disable Inspector Recording;
-              }
-          }
-          EOF
-          target/debug/wright check "$fixture" > "$stdout" 2> "$stderr"
-          test ! -s "$stdout"
-          grep -Fq '::group::wright check' "$stderr"
-          grep -Fq '::endgroup::' "$stderr"
-          ! grep -Fq 'title=Wright summary' "$stderr"
-          grep -Fq 'Wright `check`: **PASS** (exit 0)' "$GITHUB_STEP_SUMMARY"
+          {
+            echo "## OPY Integration"
+            echo ""
+            # N-level gate summary derived from the JSON report
+            if [[ -f target/v1-gates-report.json ]]; then
+              python3 - <<'PYEOF'
+          import json
+
+          r = json.load(open("target/v1-gates-report.json"))
+          s = r.get("summary", {})
+          passed = s.get("passed", 0)
+          total = s.get("total", 0)
+          state = "PASS" if passed == total else "FAIL"
+          icon = "✅" if passed == total else "❌"
+
+          print(f"### N-level gate: {icon} {state} ({passed}/{total} fixtures)")
+          print("")
+
+          failures = [(fid, f) for fid, f in r.get("fixtures", {}).items()
+                      if f.get("status") != "pass"]
+          if failures:
+              print("**Failures:**")
+              for fid, f in failures:
+                  print(f"- `{fid}`: {f.get('status', 'unknown')}")
+          else:
+              print("All fixtures passed.")
+          PYEOF
+            else
+              echo "### N-level gate: ⚠️ report not generated"
+            fi
+            echo ""
+            # Differential suite result
+            if [[ "${{ steps.differential.outcome }}" == "success" ]]; then
+              echo "### OPY differential suite: ✅ PASS"
+            else
+              echo "### OPY differential suite: ❌ FAIL (see run log for details)"
+            fi
+            if [[ -f target/wright-differential-report.json ]]; then
+              echo ""
+              echo "_Full machine-readable reports available as workflow artifacts._"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # -------------------------------------------------------------------------
+  # [3] DEL/OSTW INTEGRATION  (Wright's consumer contract with OSTW/del-rs)
+  # Keeps Wright's forward-compilation differential test against del-rs output.
+  # Semantic fixes belong in del-rs; this job validates the Wright integration.
+  # -------------------------------------------------------------------------
+  del-integration:
+    name: DEL/OSTW integration (differential)
+    needs: [paths, rust-quality]
+    if: needs.paths.outputs.del == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
 
-  lpp-client-integration:
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: linux-quality
+          cache-targets: true
+          cache-all-crates: false
+          cache-workspace-crates: false
+          cache-bin: false
+          save-if: false
+          cache-on-failure: false
+
+      - name: Run OSTW forward-compilation differential suite
+        id: ostw_diff
+        run: cargo test --locked -p wright-ostw --test differential
+
+      - name: Upload DEL/OSTW differential report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: del-ostw-differential-report
+          path: target/wright-ostw-differential-report.json
+
+      - name: Write step summary
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "## DEL/OSTW Integration"
+            echo ""
+            if [[ "${{ steps.ostw_diff.outcome }}" == "success" ]]; then
+              echo "### OSTW differential suite: ✅ PASS"
+            else
+              echo "### OSTW differential suite: ❌ FAIL (see run log for details)"
+            fi
+            if [[ -f target/wright-ostw-differential-report.json ]]; then
+              echo ""
+              echo "_Full machine-readable report available as workflow artifact._"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # -------------------------------------------------------------------------
+  # [4] LPP INTEGRATION  (Wright's Language Provider Protocol client contract)
+  # -------------------------------------------------------------------------
+  lpp-integration:
     name: LPP client integration (#142, #139)
+    needs: [paths, rust-quality]
+    if: needs.paths.outputs.lpp == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -119,7 +327,7 @@ jobs:
       # commit the integration tests were validated against (merged LPP v1,
       # PR wrightkit/language-provider-protocol#2 plus docs-only follow-ups).
       - name: Check out language-provider-protocol (pinned)
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
         with:
           repository: wrightkit/language-provider-protocol
           ref: 416b293e26e6fb2d29061608a493a7aecd2ce14f
@@ -139,12 +347,66 @@ jobs:
           cargo test --locked -p wright-driver --test lpp
           cargo test --locked -p wright-driver --test provider_edit
 
-  v1-gates:
-    name: v1 release gates (N-level, scenarios, benchmarks)
+  # -------------------------------------------------------------------------
+  # [5] CLI BEHAVIOR  (Wright CLI GitHub Actions renderer smoke test)
+  # Validates CLI output format in a real GitHub Actions environment.
+  # Related to #164 (user-facing GHA renderer); this job validates the
+  # repository CI integration, not the renderer semantics layer.
+  # -------------------------------------------------------------------------
+  cli-behavior:
+    name: Wright CLI behavior (GitHub Actions smoke)
+    needs: [paths, rust-quality]
+    if: needs.paths.outputs.cli == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+
+      - name: Build wright CLI
+        run: cargo build --locked -p wright-cli
+
+      - name: Exercise auto GitHub Actions renderer
+        shell: bash
+        run: |
+          set -euo pipefail
+          fixture="$RUNNER_TEMP/wright-gha-smoke.ws"
+          stdout="$RUNNER_TEMP/wright-gha-smoke.stdout"
+          stderr="$RUNNER_TEMP/wright-gha-smoke.stderr"
+          cat > "$fixture" <<'EOF'
+          rule ("gha smoke") {
+              event {
+                  Ongoing - Global;
+              }
+              actions {
+                  Disable Inspector Recording;
+              }
+          }
+          EOF
+          target/debug/wright check "$fixture" > "$stdout" 2> "$stderr"
+          test ! -s "$stdout"
+          grep -Fq '::group::wright check' "$stderr"
+          grep -Fq '::endgroup::' "$stderr"
+          ! grep -Fq 'title=Wright summary' "$stderr"
+          grep -Fq 'Wright `check`: **PASS** (exit 0)' "$GITHUB_STEP_SUMMARY"
+
+  # -------------------------------------------------------------------------
+  # [6] SCENARIO VALIDATION  (end-to-end compile-time scenario regression)
+  # Proves Wright compile-time WIR/emission contracts for declared scenarios.
+  # Depends on rust-quality (fundamental gate).
+  # -------------------------------------------------------------------------
+  scenario-validation:
+    name: Scenario validation (end-to-end)
+    needs: [paths, rust-quality]
+    if: needs.paths.outputs.opy == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -162,36 +424,71 @@ jobs:
           cache-on-failure: false
 
       - name: Build wright (debug)
-        run: cargo build --locked -p wright-cli -p wright-bench
-
-      - name: Validate committed compatibility evidence
-        run: python3 -m unittest discover -s compatibility/tests
-
-      - name: Run N-level gate
-        run: python3 scripts/v1-gates.py
+        run: cargo build --locked -p wright-cli
 
       - name: Run compile-time scenarios
+        id: scenarios
         run: python3 scripts/run-scenarios.py
 
-      - name: Run benchmarks
-        run: target/debug/wright-bench
-
-      - name: Upload gate reports
+      - name: Upload scenario report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
         with:
-          name: v1-gate-reports
-          path: |
-            target/v1-gates-report.json
-            target/scenarios-report.json
-            target/wright-bench-report.json
+          name: scenario-report
+          path: target/scenarios-report.json
 
-  ostw-compile-differential:
-    name: OSTW compile differential (#119)
+      - name: Write step summary
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "## Scenario Validation"
+            echo ""
+            if [[ -f target/scenarios-report.json ]]; then
+              python3 - <<'PYEOF'
+          import json
+
+          r = json.load(open("target/scenarios-report.json"))
+          s = r.get("summary", {})
+          passed = s.get("passed", 0)
+          total = s.get("total", 0)
+          icon = "✅" if passed == total else "❌"
+          state = "PASS" if passed == total else "FAIL"
+
+          print(f"### Scenarios: {icon} {state} ({passed}/{total})")
+          print("")
+
+          failures = [(sid, sc) for sid, sc in r.get("scenarios", {}).items()
+                      if not sc.get("passed")]
+          if failures:
+              print("**Failed scenarios:**")
+              for sid, sc in failures:
+                  failed_checks = [c["check"] for c in sc.get("checks", []) if not c["passed"]]
+                  print(f"- `{sid}`: {', '.join(failed_checks) or 'compile failed'}")
+          else:
+              print("All scenarios passed.")
+          PYEOF
+            else
+              echo "### Scenarios: ⚠️ report not generated"
+            fi
+            echo ""
+            echo "_Full machine-readable report available as workflow artifact._"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # -------------------------------------------------------------------------
+  # [7] BENCHMARK  (performance evidence)
+  # Non-blocking on PRs; records regression-detectable output as artifact.
+  # Depends on rust-quality so a fundamental failure skips benchmark time.
+  # -------------------------------------------------------------------------
+  benchmark:
+    name: Performance benchmarks
+    needs: [paths, rust-quality]
+    if: needs.paths.outputs.opy == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -208,22 +505,69 @@ jobs:
           save-if: false
           cache-on-failure: false
 
-      - name: Run OSTW forward-compilation differential suite
-        run: cargo test --locked -p wright-ostw --test differential
+      - name: Build wright and bench (debug)
+        run: cargo build --locked -p wright-cli -p wright-bench
+
+      - name: Run benchmarks
+        id: bench
+        run: target/debug/wright-bench
 
-      - name: Upload differential report
+      - name: Upload benchmark report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
         with:
-          name: wright-ostw-differential-report
-          path: target/wright-ostw-differential-report.json
+          name: benchmark-report
+          path: target/wright-bench-report.json
 
-  adapter:
+      - name: Write step summary
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "## Performance Benchmarks"
+            echo ""
+            if [[ "${{ steps.bench.outcome }}" == "success" ]]; then
+              echo "### Benchmarks: ✅ completed"
+            else
+              echo "### Benchmarks: ❌ FAIL"
+            fi
+            if [[ -f target/wright-bench-report.json ]]; then
+              python3 - <<'PYEOF'
+          import json
+
+          r = json.load(open("target/wright-bench-report.json"))
+          # Emit a compact table if the report has benchmark entries.
+          benches = r.get("benchmarks") or r.get("results") or []
+          if benches:
+              print("")
+              print("| Benchmark | Duration |")
+              print("| --- | --- |")
+              for b in benches[:20]:  # cap at 20 rows
+                  name = b.get("name") or b.get("id", "?")
+                  dur = (b.get("duration_ms") or b.get("elapsed_ms") or b.get("ns"))
+                  unit = "ms" if ("duration_ms" in b or "elapsed_ms" in b) else ("ns" if "ns" in b else "")
+                  print(f"| {name} | {dur}{unit} |")
+              if len(benches) > 20:
+                  print(f"_... and {len(benches) - 20} more (see artifact)_")
+          PYEOF
+              echo ""
+              echo "_Full machine-readable report available as workflow artifact._"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # -------------------------------------------------------------------------
+  # [8] OPY ADAPTER  (OverPy-to-HIR TypeScript adapter)
+  # Independent of Rust quality; only triggered by adapter/ or broad changes.
+  # -------------------------------------------------------------------------
+  opy-adapter:
     name: OverPy-to-HIR adapter
+    needs: paths
+    if: needs.paths.outputs.opy_adapter == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Install pnpm
         uses: pnpm/action-setup@v6
@@ -231,7 +575,7 @@ jobs:
           version: 11.10.0
 
       - name: Install Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: pnpm
@@ -245,40 +589,26 @@ jobs:
         run: pnpm test
         working-directory: adapter
 
-  compatibility-differential:
-    name: Native-vs-reference frontend differential
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v7
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: stable
-      - name: Restore Rust cache
-        uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: linux-quality
-          cache-targets: true
-          cache-all-crates: false
-          cache-workspace-crates: false
-          cache-bin: false
-          save-if: false
-          cache-on-failure: false
-
-      - name: Run native-vs-reference differential suite
-        run: cargo test --locked -p wright-opy --test differential
-
-      - name: Upload differential report
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: wright-differential-report
-          path: target/wright-differential-report.json
-
+  # -------------------------------------------------------------------------
+  # [9] DISTRIBUTION VALIDATION  (cross-platform package/binary smoke)
+  # Gated on rust-quality + opy-integration + lpp-integration so a
+  # fundamental or integration failure prevents wasting cross-platform runner
+  # time on packages whose source has already failed.
+  # When dist-validation is skipped due to upstream failures, a summary step
+  # explains which gate caused the skip.
+  # -------------------------------------------------------------------------
   dist-validation:
     name: Distribution validation (${{ matrix.os }})
+    needs:
+      - paths
+      - rust-quality
+      - opy-integration
+      - lpp-integration
+    if: |
+      needs.paths.outputs.dist == 'true' &&
+      needs.rust-quality.result == 'success' &&
+      needs.opy-integration.result == 'success' &&
+      needs.lpp-integration.result == 'success'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -289,7 +619,7 @@ jobs:
           - windows-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -312,7 +642,7 @@ jobs:
           cache-on-failure: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v4
         with:
           node-version: 22
 

From 72fc7285bbf80bb9f908768bf64058fad1ff4d07 Mon Sep 17 00:00:00 2001
From: Teakowa <27560638+Teakowa@users.noreply.github.com>
Date: Sat, 22 Aug 2026 19:30:32 +0800
Subject: [PATCH 2/2] ci: update GitHub Actions to latest major versions

checkout v7, setup-node v7, setup-python v7, upload-artifact v7, download-artifact v8
---
 .github/workflows/ci.yml      | 36 +++++++++++++++++------------------
 .github/workflows/release.yml | 12 ++++++------
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ad3819..a74b7c5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,7 @@ jobs:
       dist: ${{ steps.f.outputs.dist }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -107,7 +107,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -148,7 +148,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -182,7 +182,7 @@ jobs:
 
       - name: Upload OPY integration reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: opy-integration-reports
           path: |
@@ -249,7 +249,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -272,7 +272,7 @@ jobs:
 
       - name: Upload DEL/OSTW differential report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: del-ostw-differential-report
           path: target/wright-ostw-differential-report.json
@@ -306,7 +306,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -327,7 +327,7 @@ jobs:
       # commit the integration tests were validated against (merged LPP v1,
       # PR wrightkit/language-provider-protocol#2 plus docs-only follow-ups).
       - name: Check out language-provider-protocol (pinned)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: wrightkit/language-provider-protocol
           ref: 416b293e26e6fb2d29061608a493a7aecd2ce14f
@@ -360,7 +360,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -406,7 +406,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -432,7 +432,7 @@ jobs:
 
       - name: Upload scenario report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: scenario-report
           path: target/scenarios-report.json
@@ -488,7 +488,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@master
@@ -514,7 +514,7 @@ jobs:
 
       - name: Upload benchmark report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: benchmark-report
           path: target/wright-bench-report.json
@@ -567,7 +567,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install pnpm
         uses: pnpm/action-setup@v6
@@ -575,7 +575,7 @@ jobs:
           version: 11.10.0
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: pnpm
@@ -619,10 +619,10 @@ jobs:
           - windows-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -642,7 +642,7 @@ jobs:
           cache-on-failure: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c853092..f542b55 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -200,7 +200,7 @@ jobs:
       RELEASE_TAG: ${{ inputs.tag }}
     steps:
       - name: Download release artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: wright-*
           path: artifacts
@@ -255,7 +255,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download release artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: wright-*
           path: artifacts
@@ -318,7 +318,7 @@ jobs:
       RELEASE_TAG: ${{ inputs.tag }}
     steps:
       - name: Download generated Homebrew formula
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: homebrew-formula
           path: formula
@@ -376,7 +376,7 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Download release artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: wright-*
           path: artifacts
@@ -436,7 +436,7 @@ jobs:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
       - name: Download npm tarballs
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: npm-packages
           path: npm-packages
@@ -486,7 +486,7 @@ jobs:
       packages: write
     steps:
       - name: Download npm tarballs
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: npm-packages
           path: npm-packages