ci: bound mini execution with parallel hosted macOS fallback

.github/actionlint.yaml

@@ -0,0 +1,7 @@
+self-hosted-runner:
+  labels: [mac-arm64-mini]
+# GitHub supports cache-mode; actionlint 1.7.12 predates the syntax.
+paths:
+  .github/workflows/macos-mini.yml:
+    ignore:
+      - 'unexpected key "cache-mode" for "workflow" section'

.github/actions/rust-setup/action.yml

@@ -27,9 +27,12 @@ runs:
   using: "composite"
   steps:
     # Avoid paying for cleanup when the filesystem containing the workspace has
-    # enough room. Keep the cleanup fallback for low or unreadable disk space.
+    # enough room. Only hosted images use the cleanup fallback; persistent
+    # self-hosted runners report low/unreadable disk without privileged cleanup.
     - name: Guard workspace disk space
       shell: bash
+      env:
+        ASTRA_CI_RUNNER_ENVIRONMENT: ${{ runner.environment }}
       run: |
         set -euxo pipefail
         disk_guard_workspace="${GITHUB_WORKSPACE:?GITHUB_WORKSPACE must be set}"
@@ -51,6 +54,9 @@ runs:
         if [[ "${disk_guard_measurement}" == "valid" ]] &&
           (( disk_guard_available_kib >= disk_guard_threshold_kib )); then
           echo "Disk guard decision: skip cleanup; workspace filesystem free=${disk_guard_available_kib} KiB; threshold=${disk_guard_threshold_kib} KiB (30 GiB)."
+        elif [[ "${ASTRA_CI_RUNNER_ENVIRONMENT:-}" == self-hosted ]]; then
+          echo "::error::Disk guard decision: fail self-hosted; measurement=${disk_guard_measurement}; workspace filesystem free=${disk_guard_available_kib:-unavailable} KiB; threshold=${disk_guard_threshold_kib} KiB (30 GiB). Reclaim runner disk before retrying."
+          exit 1
         else
           echo "Disk guard decision: run cleanup; measurement=${disk_guard_measurement}; workspace filesystem free=${disk_guard_available_kib:-unavailable} KiB; threshold=${disk_guard_threshold_kib} KiB (30 GiB)."
           sudo rm -rf /usr/share/dotnet
@@ -63,9 +69,7 @@ runs:
         df -h "${disk_guard_workspace}"
 
     - name: Install pinned Rust toolchain
-      # The repository toolchain also owns test-created Cargo fixtures.
-      shell: bash
-      run: rustc --version
+      uses: ./.github/actions/rust-toolchain
 
     - uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2
       if: ${{ inputs.install-nextest == 'true' }}

.github/actions/rust-toolchain/action.yml

@@ -0,0 +1,27 @@
+name: Install repository Rust toolchain
+description: Bootstrap rustup and install the toolchain from rust-toolchain.toml
+runs:
+  using: composite
+  steps:
+    - name: Install pinned Rust toolchain
+      shell: bash
+      run: |
+        set -euo pipefail
+        ci_cargo_bin="${CARGO_HOME:-$HOME/.cargo}/bin"
+        export PATH="$ci_cargo_bin:$PATH"
+        if ! command -v rustup >/dev/null 2>&1; then
+          curl --proto '=https' --tlsv1.2 --retry 3 --location --silent --show-error --fail \
+            https://sh.rustup.rs | sh -s -- --default-toolchain none --no-modify-path -y
+        fi
+        echo "$ci_cargo_bin" >> "$GITHUB_PATH"
+        # Resolve the repository pin rather than a runner service override.
+        unset RUSTUP_TOOLCHAIN
+        # Older rustup installs implicitly on show; newer versions require the
+        # explicit install. Both read the repository file, including components.
+        rustup show active-toolchain || rustup toolchain install
+        ci_rust_toolchain="$(rustup show active-toolchain)"
+        ci_rust_toolchain="${ci_rust_toolchain%% *}"
+        test -n "$ci_rust_toolchain"
+        export RUSTUP_TOOLCHAIN="$ci_rust_toolchain"
+        echo "RUSTUP_TOOLCHAIN=$RUSTUP_TOOLCHAIN" >> "$GITHUB_ENV"
+        rustc --version

.github/workflows/macos-mini.yml

@@ -0,0 +1,63 @@
+name: macOS mini worker
+run-name: Mac mini for Test Suite ${{ inputs.source_run_id }}/${{ inputs.source_attempt }} ${{ inputs.source_sha }}
+on:
+  workflow_dispatch:
+    inputs:
+      source_run_id:
+        required: true
+        type: string
+      source_attempt:
+        required: true
+        type: string
+      source_sha:
+        required: true
+        type: string
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
+cache-mode: read
+concurrency:
+  group: macos-mini-${{ inputs.source_run_id }}-${{ inputs.source_attempt }}
+  cancel-in-progress: false
+defaults:
+  run:
+    shell: bash
+env:
+  CARGO_INCREMENTAL: "0"
+  CARGO_TERM_COLOR: always
+jobs:
+  execute:
+    runs-on: [self-hosted, macOS, ARM64, mac-arm64-mini]
+    timeout-minutes: 65
+    steps:
+      - name: Checkout control policy
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          path: .ci-control
+          persist-credentials: false
+      - name: Validate mini dispatch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_RUN_ID: ${{ inputs.source_run_id }}
+          SOURCE_ATTEMPT: ${{ inputs.source_attempt }}
+          SOURCE_SHA: ${{ inputs.source_sha }}
+        run: python3 .ci-control/scripts/ci/macos_dispatch.py admit --run-id "$SOURCE_RUN_ID" --attempt "$SOURCE_ATTEMPT" --sha "$SOURCE_SHA"
+      - name: Checkout candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Prepare Rust
+        uses: ./.github/actions/rust-setup
+        with:
+          shared-key: ci-terminal-pty
+          save-cache: "false"
+          install-nextest: "false"
+      - name: Prepare Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+        with:
+          node-version-file: .nvmrc
+      - name: Run all macOS lanes
+        run: bash scripts/ci/run-macos-lanes.sh all

.github/workflows/macos-scheduler.yml

@@ -0,0 +1,30 @@
+name: macOS mini scheduler
+on:
+  workflow_run:
+    workflows: [Test Suite]
+    types: [in_progress, completed]
+permissions:
+  contents: read
+  actions: write
+  pull-requests: read
+concurrency:
+  group: macos-scheduler-${{ github.event.workflow_run.id }}-${{ github.event.workflow_run.run_attempt }}
+  cancel-in-progress: false
+jobs:
+  schedule:
+    if: github.event.workflow_run.run_attempt == 1 && github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 70
+    steps:
+      # Only the default-branch controller is loaded; it never executes PR code.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Schedule and bound the mini attempt
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DISPATCH_MODE: ${{ github.event.action == 'completed' && 'cleanup' || 'schedule' }}
+          SOURCE_RUN_ID: ${{ github.event.workflow_run.id }}
+          SOURCE_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
+        run: python3 scripts/ci/macos_dispatch.py "$DISPATCH_MODE" --run-id "$SOURCE_RUN_ID" --attempt "$SOURCE_ATTEMPT"