[cunninghamcard-bit]

Requested by li · project thread

Before: C ABI (ASan + LSan) and aimux-ffi (aarch64-unknown-linux-gnu), added in #265, ran on every pull request, documentation-only ones included, and CI result, the one check branch protection requires, did not wait for them. A pull request whose sanitizer run found a leak still showed CI result green and could merge.

After: both jobs run when the C ABI can change (aimux-ffi/ or shared Rust code), are skipped on documentation-only and binding-only pull requests, and CI result fails when either of them fails.

Changes .github/workflows/ci.yml only (8 lines).

How CI decides and reports today

pull_request / push to master
├─ changes job "Detect code changes"                         ci.yml:70
│   └─ step diff                                             :83
│       ├─ changed PATHSPEC…: does this change touch them?
│       ├─ code   = anything outside top-level *.md, docs/, rfc/, assets/
│       ├─ shared = code outside bindings/ and aimux-ffi/
│       └─ run map: job NAME DIRS… → true when shared, or DIRS changed   :135-155
│            {"rust-test": …, "ffi-build": …, "jvm-bindings": …, …}
├─ each test job
│     needs: changes
│     if: fromJSON(needs.changes.outputs.run)['<job>']       e.g. :212
└─ ci-result "CI result"                                     :802
    ├─ if: always()                                          :804
    ├─ needs: changes + every job above                      :805-818
    └─ jq: changes succeeded, and every needed job succeeded
           or was skipped because the run map said false     :826-829

CI result only sees the jobs in its needs. A job outside that list can fail without changing it, and a job without needs: changes / if: runs on every pull request whatever it changes.

What this pull request changes

changes → run map
├─ + "ffi-sanitizers": shared or aimux-ffi/ changed           ci.yml:148
└─ + "ffi-linux-arm":  shared or aimux-ffi/ changed           :149
ffi-sanitizers "C ABI (ASan + LSan)"                          :460
└─ + needs: changes, if: run['ffi-sanitizers']                :463-464
ffi-linux-arm "aimux-ffi (aarch64-unknown-linux-gnu)"         :483
└─ + needs: changes, if: run['ffi-linux-arm']                 :486-487
ci-result
└─ + needs: ffi-sanitizers, ffi-linux-arm                     :811-812

Both jobs build aimux-ffi, so they get the same rule as rust-test: they run when the C ABI or the shared Rust code it wraps changes (scripts/test-c-abi.sh counts as shared). Every job in the workflow is now in the run map and in CI result's needs.

Checks

• Ran the changes script on test commits: a README.md change gives false for both jobs; a change in aimux-ffi/src, aimux-core/src or scripts/test-c-abi.sh gives true; a bindings/python change gives false for both and true for python-binding.
• Ran the CI result jq expression: a failed ffi-sanitizers fails it; a skipped job whose run-map entry is false passes.
• Every job with a run-map if: has an entry in the map, and every job except ci-result is in its needs.

---

Generated by Claude Code

[eric8810]

CI 逻辑检查

• changes 的 run map 新增 ffi-sanitizers / ffi-linux-arm，两个 job 都补了 needs: changes 和对应 if，ci-result 也加入 needs，整条链路一致。
• 文档-only 和 bindings-only 的跳过路径符合预期：shared 覆盖共享 Rust 代码，aimux-ffi 或 scripts/test-c-abi.sh 变更会触发两个 job。
• 未发现阻塞项。

Approve.