Files
PaperClipAI/.github/scripts
DottaandPaperclip 8e7b5db822 ci: add protected routing workflow for reserved AWS capacity (#16039)
## Thinking Path

> - Paperclip uses CI to verify changes before release.
> - Trusted PR tests can run on isolated AWS workers.
> - Their runner-selection job currently waits for GitHub-hosted
capacity.
> - A large hosted test queue therefore blocks admission to AWS.
> - A dedicated routing workflow lets us reserve capacity for metadata
validation.
> - This PR adds that workflow without changing the active PR caller.

## Linked Issues or Issue Description

**Issue type**

CI reliability enhancement.

**Where is the issue?**

The Select trusted runner job in PR CI.

**What's wrong?**

The routing job competes with a large hosted test queue. Its sampled
median wait was about 20 minutes. AWS tests cannot begin before this job
finishes.

**Suggested fix**

Add a protected reusable routing workflow. Deploy its dedicated AWS
pool, then switch the PR caller in a follow-up PR. No overlapping open
PR or issue was found.

## What Changed

- Add ci-routing.yml with the existing author, sender, rerun actor,
repository, head, merge, and stack checks.
- Target the dedicated paperclip-ci-routing-x64 Fleet.
- Export runner and full_ci decisions to reusable workflow callers.
- Add tests for metadata-only execution, reserved placement, and output
forwarding.
- Keep the active PR caller unchanged until the pool is deployed.

## Verification

- The routing tests passed (30 tests), including 20 executed
runner-selection cases and 8 executed stack-scope cases.
- Existing routing allow/deny scenarios also passed with the extracted
script (16 cases).
- A live qualification job selected AWS and passed on the reserved
routing pool in
https://github.com/paperclipai/paperclip/actions/runs/38308312153/job/115007621128
while the hosted gate remained queued.
- actionlint passed with the dedicated custom runner label declared in
its local configuration.
- git diff --check passed.
- Full pnpm typecheck/test/build cannot run in this worktree because
dependencies are not installed. The change is limited to workflow YAML
and Node tests.
- After merge, configure the restricted runner group, deploy the pool,
and dispatch ci-routing.yml on master. The unused workflow does not
affect current PR placement.

## Risks

- The maintainer explicitly approved merging this rollout after
current-head Greptile 5/5 and focused verification, while the hosted CI
checks remain queued.

- The dedicated Fleet must exist before the workflow can receive a
runner. This PR introduces the workflow without switching active PR CI.
- The group must authorize only ci-routing.yml on protected master and
canonical repository ID 1170821064.
- The routing workflow runs no checkout or PR code and has read-only
permissions. The test admission checks are unchanged.

## Model Used

- OpenAI GPT-6 via Codex, with reasoning, shell tools, and file editing.
The exact runtime model ID and context window are not exposed in this
session.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass (focused routing and
workflow tests; full pnpm commands are blocked by missing worktree
dependencies)
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] Required CI was checked; the maintainer explicitly approved an
admin bypass for queued checks after clean review
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-12 16:14:35 -05:00
..