fix(ci): gate cross-package conformance scans by their real input set (#7802)

.github/workflows/ci.yml

@@ -307,6 +307,34 @@ jobs:
  echo "Affected-set diff base: $SCM_BASE (merge-base of origin/$BASE_REF and HEAD)"
  echo "Frozen payload base.sha: $PINNED_BASE_SHA -- $BASE_REF has moved $DRIFT commit(s) since it was frozen, and that drift is exactly what this step used to charge to this PR."
  TURBO_SCM_BASE="$SCM_BASE" pnpm exec turbo ls --affected --output=json > "$RUNNER_TEMP/turbo-ls.json"
+ # `turbo ls --affected` answers "which packages does the dependency
+ # GRAPH reach from this diff" — and some suites read files the graph
+ # does not connect them to. spec's api-methods-batch-conformance scan
+ # walks every `*.object.ts` in the monorepo while spec declares no
+ # dependency on the packages it judges (nor should it: the scan reads
+ # source text precisely to avoid inverting the spec -> * direction).
+ # A platform-objects-only diff therefore left it unrun, and #7769
+ # landed a violation on `main` that only PRs touching `spec` ever saw.
+ # Measured on turbo 2.10.7: 51 packages affected by that diff, spec
+ # not among them.
+ #
+ # So packages that declare a cross-package input radius are unioned
+ # back in when the diff touches it. The declarations, and the static
+ # detector that refuses to let a new cross-package scan go
+ # undeclared, live in the script (`pnpm check:cross-package-test-inputs`).
+ #
+ # Failure here falls back to the FULL package list, never to the
+ # affected-only set: same posture as the merge-base fallback below
+ # (#6195), and the same reason — the full list is a strict superset,
+ # so doubt costs minutes rather than coverage. This is the FILTER
+ # CONTRACT's half 1 applied one layer down.
+ if ! git diff --name-only "$SCM_BASE" HEAD > "$RUNNER_TEMP/changed-files.txt" \
+ || ! node scripts/check-cross-package-test-inputs.mjs \
+ --union-into "$RUNNER_TEMP/turbo-ls.json" \
+ --changed "$RUNNER_TEMP/changed-files.txt"; then
+ echo "::warning::Could not union cross-package scans into the affected set; falling back to the full package list for this shard."
+ pnpm exec turbo ls --output=json > "$RUNNER_TEMP/turbo-ls.json"
+ fi
  else
  # Falling back to the FULL package list, never to the frozen
  # base.sha. This is not the #4690 silent-skip anti-pattern: that is

.github/workflows/lint.yml

@@ -537,6 +537,27 @@ jobs:
  - name: Required-context name pin
  run: pnpm check:required-contexts
 
+ # Cross-package test inputs (#7802). A test that resolves the repo root
+ # and walks it has an input set far wider than its own package, and BOTH
+ # of CI's scoping layers judge it by where it LIVES: `turbo ls --affected`
+ # reaches packages through the dependency GRAPH, and turbo's task cache
+ # hashes `$TURBO_DEFAULT$`, which is package-local. So spec's
+ # `*.object.ts` conformance scan went unrun on a platform-objects-only
+ # diff, AND replayed a cached green in the merge-queue build that runs the
+ # full package list — a violation reached `main` with every gate green and
+ # was then charged to the next unrelated PR that happened to touch `spec`.
+ # Twenty such tests, in eight packages, exist today.
+ # This gate finds the escaping tests ITSELF, statically — nothing has to
+ # be registered to be DETECTED — and fails on any package that has one and
+ # no declared input radius, on a declaration gone stale, on a declared
+ # glob turbo.json does not hash, and on a radius too narrow to cover the
+ # paths its own tests name. The point is what happens by default: a new
+ # cross-package scan nobody remembers to register produces a RED GATE
+ # naming it and the globs to write, not a silent skip.
+ # Reads ~2000 test sources; sub-second.
+ - name: Cross-package test inputs
+ run: pnpm check:cross-package-test-inputs
+
  # #4248 packaging-hygiene guard. Without a `files` whitelist npm packs the
  # whole package directory, and 20 of the 49 publishable packages declared
  # none — so consumers installed TypeScript sources, unit tests and build

package.json

@@ -78,6 +78,7 @@
  "check:workflow-status-functions": "node scripts/check-workflow-status-functions.mjs --self-test && node scripts/check-workflow-status-functions.mjs",
  "check:shard-attestation": "node scripts/check-shard-attestation.mjs --self-test && node scripts/check-shard-attestation.mjs",
  "check:required-contexts": "node scripts/check-required-contexts.mjs --self-test && node scripts/check-required-contexts.mjs",
+ "check:cross-package-test-inputs": "node scripts/check-cross-package-test-inputs.mjs --self-test && node scripts/check-cross-package-test-inputs.mjs",
  "check:published-files": "node scripts/check-published-files.mjs --self-test && node scripts/check-published-files.mjs",
  "check:type-check-coverage": "node scripts/check-type-check-coverage.mjs --self-test && node scripts/check-type-check-coverage.mjs",
  "check:type-check-debt": "node scripts/check-type-check-coverage.mjs --self-test && node scripts/check-type-check-coverage.mjs --re-measure",