ci: per-variant journey gates and an affected-scoped framework matrix

[fforootd]

Summary

Rungs 2+3 on the affected-gating probe from #731: the three journey steps stop being all-or-nothing, and the fresh-app framework matrix scales to what actually moved.

Per-variant journey gating (rung 2). The variant↔surface map lives as task-space constants in scripts/ci-mode.mjs — never file globs, moon's graph stays the authority:

variant	triggers
fresh-app	shared surface ∪ any sdk-*:build ∪ journey project
passkey-preset, test-kit	shared surface ∪ journey project
(shared surface)	server:test, cli:build, api:build, config:build, testing:build, login-ui:build, components:build, sdk-core:build, sdk-next:build

The key discriminator is server:test as the go-side signal instead of server:build: console embeds into the server binary, so console-only changes mark server:build affected — but the journeys never render the console, and embedding breakage is server:build's own job inside the moon ci graph. server:test moves only when Go/API sources move. The snapshot runs iff any journey does (tarball handoff stays a filesystem contract moon cannot see).

Net effect, live-probed against real moon queries: console-only PRs run the e2e suites but zero journeys and no snapshot (~6.4 min off that class); single-SDK PRs run only the fresh-app matrix (passkey/testkit skip, −2.7 min); login-ui/testing-kit/journey changes still run all three.

Affected-scoped matrix (rung 3). journey_matrix=single collapses the fresh-app journey to --framework next unless an SDK build, cli:build (owns the scaffold templates), or the journey project moved — the scaffolded flow widget is framework-independent, so a server-only change proves as much on one framework as on five (~1.3 min off every go-side PR).

Query-failure observability. Investigating why the docs-only #710 ran the full 9.6-min tail post-#731: its moon query failed transiently (658 ms step, silent) and correctly failed open — but nothing said so. The initial theory (a moved base tip poisons moon's two-dot diff) was reproduced against and disproved — moon merge-bases internally — so no base-handling change ships; instead, query failure exit codes and non-JSON stdout now print to the step log, and the forced-full reason prints to stdout as well as the step summary.

Validation

• node --test scripts/ci-mode.test.mjs — 19/19; fixtures are live moon query captures from current main (new sdk-vue class; console/login-ui/testing refreshed 2026-08-04).
• moon run workspace:test — same suite through moon (:test selection).
• Live probes against real queries on committed diffs: console-only → journeys/snapshot false, suites true; go-only → all gates true with journey_matrix=single; aging-branch repro (fork 3 commits back, current-tip base) → correctly gated, disproving the base-staleness theory.
• YAML parse of ci.yml.
• This PR's own run force-fulls (touches scripts/ + .github/) — the safety rule, as designed.

Release notes / changeset

• No changeset required — no shipped behavior changed (CI workflow + CI-glue script + docs).

Notes

• Console-only PRs lose the release-snapshot artifact (their journeys skip). Console review happens on the Vercel preview, and any code path that genuinely feeds the snapshot re-enables it via the surface map — flag it if you want a console-triggered snapshot anyway.
• passkey-preset and test-kit currently share one trigger surface (both scaffold Next and drive the widget); they have separate gates so the map can diverge later without workflow changes.
• The go-side probe commit history from the investigation is in the branch history; the merge-base machinery was deliberately built, disproved, and removed before this PR.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nextgen	Ready	Preview	Aug 7, 2026 3:02pm
nextgen-docs	Ready	Preview	Aug 7, 2026 3:02pm
nextgen-mock-zitadel	Ready	Preview	Aug 7, 2026 3:02pm

[github-actions]

⚠️ No Changeset found

Latest commit: 2ceb783

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Pull request overview

This PR refines the full-pr CI tail gating to be more granular and cheaper: journeys are no longer all-or-nothing, and the fresh-app journey’s framework matrix is reduced to a single representative framework unless framework-specific surfaces are affected.

Changes:

• Split the single journeys gate into per-variant gates (journey_fresh_app, journey_passkey, journey_testkit) driven by an explicit task-space trigger map in scripts/ci-mode.mjs.
• Add journey_matrix output (full vs single) and wire it into the fresh-app journey step to optionally constrain the framework matrix to --framework next.
• Improve observability for affected-query failures (stderr passthrough + explicit failure line) and extend the unit test suite with new change-class fixtures.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
scripts/ci-mode.mjs	Implements per-variant journey gates, journey_matrix scope, and better query-failure logging while preserving fail-open behavior.
scripts/ci-mode.test.mjs	Expands coverage to new gating variants and matrix-collapsing behavior across representative affected-task slices.
.github/workflows/ci.yml	Consumes the new per-variant gates and passes journey_matrix into the fresh-app journey step to optionally constrain the framework selection.
CONTRIBUTING.md	Updates CI documentation to describe per-variant journey gating, matrix collapsing, and snapshot coupling behavior.