ci: fractional board validation with exact-SHA full gate

.github/workflows/README.md

@@ -2,9 +2,34 @@
 
 CI/CD workflows for the fbuild project, covering lint, test, documentation, and binary builds.
 
-## CI Checks (push/PR)
-
-- **`check-{ubuntu,windows}.yml`** -- Clippy + tests per platform (no macOS runner: macOS
+## CI tiers
+
+- `ci-minimal.yml` runs on ordinary PRs and `main` pushes: Linux workspace
+  check, Clippy, tests, and the existing small independent policy gates below.
+- Add the `ci-test` PR label (or dispatch manually) for the Linux check plus
+  the Arduino Uno quick/release firmware build.
+- Add the `ci-full` PR label (or dispatch manually) for all boards in
+  `ci/board_families.json`, Linux and Windows workspace checks, Dylint,
+  acceptance, benchmarks, QEMU runtime, fmt, docs, MSRV, board validation,
+  and crate gates. The release workflow calls this tier at its selected
+  commit ref before publication.
+- `ci-minimal` owns the PR status `CI selected coverage`. It runs the selected
+  reusable tiers when labels are present, and fails if a selected tier is
+  skipped, fails, or reports incomplete full coverage. Require this stable
+  status for ordinary PRs alongside the independent fmt, docs, MSRV, board
+  validation, and crate-gate statuses. The unselected tiers allocate no PR
+  runners. The selected tier owns the Linux workspace check; when both labels
+  are present, `ci-full` subsumes `ci-test`.
+- The full and nightly board matrices execute identical build inputs once.
+  Each matrix row carries `workflow_aliases` so every listed board workflow
+  remains represented, including legacy spelling aliases.
+- Per-board `build-*.yml` files are manual/reusable only. Their triggers are
+  generated by `ci/render_workflows.py`; the nightly sweep still runs every
+  board independently of PR labels.
+
+## Independent lightweight checks (push/PR)
+
+- **`check-{ubuntu,windows}.yml`** -- Reusable Clippy + tests per platform (no macOS runner: macOS
   binaries are cross-built from Linux in the release matrix, see below)
 - **`fmt.yml`** -- Rustfmt check | **`docs.yml`** -- Doc build with `-D warnings`
 - **`msrv.yml`** -- MSRV 1.95.0 verification | **`validate-boards.yml`** -- Board JSON validation
@@ -43,7 +68,7 @@ Exempt, with the reason recorded in `ci/check_workflow_concurrency.py`:
 would share one group and cancel each other), `hw-ci.yml` (cancelling mid-flash
 can wedge real hardware), and `add-to-project.yml` (fires once on PR open).
 
-Per-board files get the block from `ci/render_workflows.py`; everything else
+Per-board files and the CI tier workflows get the block from `ci/render_workflows.py`; everything else
 carries it by hand. `ci-workflow-drift.yml` enforces both halves via
 `ci/check_workflow_concurrency.py` -- a new PR-triggered workflow without the
 block fails CI with a copy-paste fix.
@@ -53,7 +78,7 @@ block fails CI with a copy-paste fix.
 - **`benchmark-build-comparison.yml`** -- Arduino CLI vs PlatformIO vs fbuild Blink cold/warm benchmark; runs nightly, manually, and for relevant pushes to `main`, then force-publishes the one-commit `benchmark-stats` branch and deploys its site to GitHub Pages
 - **`esp32s3-size-parity.yml`** -- builds an ESP32-S3 Blink with PlatformIO and fbuild on the same pinned pioarduino platform and fails if fbuild's `firmware.bin` is larger (#1432); runs once a day and manually, never on push/PR
 
-## Per-Board Builds (push/PR)
+## Per-Board Builds (manual/reusable, called by CI tiers)
 
 - **`build-esp32{c2,c3,c5,c6,dev,h2,p4,s2,s3}.yml`** -- ESP32 variants
 - **`build-esp8266.yml`** -- ESP8266
@@ -86,6 +111,9 @@ block fails CI with a copy-paste fix.
 ### Bumping soldr
 
 All `zackees/setup-soldr@v0` steps pin the installed soldr binary version.
+The full board template temporarily pins the setup action itself to merged
+commit `f63d8987580fd50667d95b19130e82d9691ddd75` as a downstream canary
+for setup-soldr#517 before the floating `v0` reference moves.
 When bumping it, first confirm the proposed tag is a published, non-draft
 release with the required platform assets. Update every setup-soldr call site
 in one PR, retain the previous pin until that release exists, and require
@@ -115,7 +143,13 @@ For Windows artifacts, verify `fbuild.exe`, `fbuild-daemon.exe`, and
 
 ### Autonomous Releases
 
-`release-auto.yml` follows the attested release pattern used by `soldr`:
+`release-auto.yml` is dispatched explicitly with a required exact candidate SHA;
+ordinary version-file pushes never start it. It follows the attested release
+pattern used by `soldr`:
+
+Publication is presently fail-closed at `runtime-coverage`: no trusted same-SHA
+physical-board result covers every supported platform. Dry-run dispatches remain
+usable; `publish=true` cannot create a tag or upload until that CI proof is wired.
 
 - reads the workspace/package version from `Cargo.toml` and `pyproject.toml`
 - skips the run if the tag already exists or PyPI already has that version

.github/workflows/acceptance-205.yml

@@ -4,23 +4,16 @@ on:
   # Don't run on every PR -- these tests take 10+ minutes each because they
   # download Teensyduino + arm-gcc + STM32duino. Trigger explicitly.
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        required: false
+        default: ""
   schedule:
     # Nightly at 04:00 UTC. Catches drift in Teensyduino / STM32duino
     # framework downloads and fbuild's resolver behaviour.
     - cron: '0 4 * * *'
-  pull_request:
-    paths:
-      # Run when something that could affect resolver behaviour changes.
-      - 'crates/fbuild-header-scan/**'
-      - 'crates/fbuild-library-select/**'
-      - 'crates/fbuild-build/src/framework_libs.rs'
-      - 'crates/fbuild-build/src/teensy/**'
-      - 'crates/fbuild-build/src/stm32/**'
-      - 'crates/fbuild-build/tests/teensylc_acceptance.rs'
-      - 'crates/fbuild-build/tests/teensy30_acceptance.rs'
-      - 'crates/fbuild-build/tests/teensy41_acceptance.rs'
-      - 'crates/fbuild-build/tests/stm32_acceptance.rs'
-      - '.github/workflows/acceptance-205.yml'
 
 # Auto-cancel superseded PR runs: pushing again to a feature branch
 # supersedes the in-flight run instead of queueing behind it. Non-PR
@@ -58,6 +51,8 @@ jobs:
             test_fn: teensy41_cold_library_selection_meets_205_ac6
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref }}
       - uses: astral-sh/setup-uv@v3
       - name: Setup soldr
         uses: zackees/setup-soldr@v0

.github/workflows/bench-205.yml

@@ -2,13 +2,12 @@ name: Perf benches (#205)
 
 on:
   workflow_dispatch:
-  pull_request:
-    paths:
-      - 'crates/fbuild-header-scan/**'
-      - 'crates/fbuild-library-select/**'
-      - 'crates/fbuild-test-support/src/mini_framework.rs'
-      - 'bench/fastled-examples/**'
-      - '.github/workflows/bench-205.yml'
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        required: false
+        default: ""
 
 # Auto-cancel superseded PR runs: pushing again to a feature branch
 # supersedes the in-flight run instead of queueing behind it. Non-PR
@@ -42,6 +41,8 @@ jobs:
             target: P-01-mini (warm cache against MiniFramework, baseline TBD)
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref }}
       - uses: astral-sh/setup-uv@v3
       - name: Setup soldr
         uses: zackees/setup-soldr@v0
@@ -82,6 +83,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref }}
       - uses: astral-sh/setup-uv@v3
       - name: Setup soldr
         uses: zackees/setup-soldr@v0

.github/workflows/build-apollo3_red.yml

@@ -4,18 +4,6 @@ name: Build Apollo3 RedBoard
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/apollo3_red/**'
-      - 'crates/fbuild-build-arm/src/apollo3/**'
-      - '.github/workflows/build-apollo3_red.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/apollo3_red/**'
-      - 'crates/fbuild-build-arm/src/apollo3/**'
-      - '.github/workflows/build-apollo3_red.yml'
 
 concurrency:
   group: build-apollo3_red.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-apollo3_thing_explorable.yml

@@ -4,18 +4,6 @@ name: Build Apollo3 expLoRaBLE
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/apollo3_thing_explorable/**'
-      - 'crates/fbuild-build-arm/src/apollo3/**'
-      - '.github/workflows/build-apollo3_thing_explorable.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/apollo3_thing_explorable/**'
-      - 'crates/fbuild-build-arm/src/apollo3/**'
-      - '.github/workflows/build-apollo3_thing_explorable.yml'
 
 concurrency:
   group: build-apollo3_thing_explorable.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-atmega8.yml

@@ -4,18 +4,6 @@ name: Build ATmega8
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/atmega8/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-atmega8.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/atmega8/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-atmega8.yml'
 
 concurrency:
   group: build-atmega8.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-atmega8a.yml

@@ -4,18 +4,6 @@ name: Build ATmega8A
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/atmega8a/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-atmega8a.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/atmega8a/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-atmega8a.yml'
 
 concurrency:
   group: build-atmega8a.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-attiny1604.yml

@@ -4,18 +4,6 @@ name: Build ATtiny1604
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny1604/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny1604.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny1604/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny1604.yml'
 
 concurrency:
   group: build-attiny1604.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-attiny1616.yml

@@ -4,18 +4,6 @@ name: Build ATtiny1616
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny1616/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny1616.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny1616/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny1616.yml'
 
 concurrency:
   group: build-attiny1616.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-attiny4313.yml

@@ -4,18 +4,6 @@ name: Build ATtiny4313
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny4313/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny4313.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny4313/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny4313.yml'
 
 concurrency:
   group: build-attiny4313.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-attiny85.yml

@@ -4,18 +4,6 @@ name: Build ATtiny85
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny85/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny85.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny85/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny85.yml'
 
 concurrency:
   group: build-attiny85.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-attiny88.yml

@@ -4,18 +4,6 @@ name: Build ATtiny88
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny88/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny88.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/attiny88/**'
-      - 'crates/fbuild-build-mcu/src/avr/**'
-      - '.github/workflows/build-attiny88.yml'
 
 concurrency:
   group: build-attiny88.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-blackpill.yml

@@ -4,18 +4,6 @@ name: Build BlackPill F411CE
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/blackpill_f411ce/**'
-      - 'crates/fbuild-build-arm/src/stm32/**'
-      - '.github/workflows/build-blackpill.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/blackpill_f411ce/**'
-      - 'crates/fbuild-build-arm/src/stm32/**'
-      - '.github/workflows/build-blackpill.yml'
 
 concurrency:
   group: build-blackpill.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-bluepill.yml

@@ -4,18 +4,6 @@ name: Build BluePill F103C8
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/bluepill_f103c8/**'
-      - 'crates/fbuild-build-arm/src/stm32/**'
-      - '.github/workflows/build-bluepill.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/bluepill_f103c8/**'
-      - 'crates/fbuild-build-arm/src/stm32/**'
-      - '.github/workflows/build-bluepill.yml'
 
 concurrency:
   group: build-bluepill.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}

.github/workflows/build-ch32l103.yml

@@ -4,18 +4,6 @@ name: Build CH32L103
 on:
   workflow_dispatch: {}
   workflow_call: {}
-  push:
-    branches: [main]
-    paths:
-      - 'tests/platform/ch32l103/**'
-      - 'crates/fbuild-build-mcu/src/ch32v/**'
-      - '.github/workflows/build-ch32l103.yml'
-  pull_request:
-    branches: [main]
-    paths:
-      - 'tests/platform/ch32l103/**'
-      - 'crates/fbuild-build-mcu/src/ch32v/**'
-      - '.github/workflows/build-ch32l103.yml'
 
 concurrency:
   group: build-ch32l103.yml-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}