[v1.0] De-duplicate invariant gates across the test matrix

[codeforester]

Goal

Retain the current coverage and platform confidence while eliminating repeated invariant work from every matrix lane.

Background

The 15-way OS/Python matrix installs all dev/quality dependencies and runs the complete full_validate.sh aggregate in every job:

base-cli/.github/workflows/tests.yml

Lines 15 to 39 in 1df8bc4

	validate:
	name: Validate (${{ matrix.os }}, Python ${{ matrix.python-version }})
	strategy:
	fail-fast: false
	matrix:
	os:
	- macos-latest
	- ubuntu-latest
	- windows-latest
	python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
	runs-on: ${{ matrix.os }}
	timeout-minutes: 10
	defaults:
	run:
	shell: bash
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- name: Set up Python
	uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: ${{ matrix.python-version }}
	- name: Install full validation dependencies
	run: python -m pip install ".[dev,typer,quality]"
	- name: Run authoritative validation gate
	run: ./tests/full_validate.sh

That aggregate runs the complete tests+coverage suite, strict typing, Ruff, docs, changelog, schemas, Python/Node contract fixtures, dashboard generation, benchmark, compileall, coverage floors, and Bandit:

base-cli/tests/full_validate.sh

Lines 14 to 34 in 1df8bc4

	./tests/validate.sh
	python -m pytest --cov=base_cli --cov-report=term-missing --cov-report=json:coverage.json --cov-fail-under=80
	python -m mypy --strict examples/typed_consumer.py
	python -m mypy --strict lib/python/base_cli
	ruff format --check lib/python/base_cli scripts examples tests
	ruff check lib/python/base_cli scripts examples tests
	python scripts/validate_docs.py
	python scripts/validate_changelog.py
	python scripts/validate_schemas.py
	python scripts/validate_contract_fixtures.py
	if command -v node >/dev/null 2>&1; then
	node scripts/validate_contract_fixtures.mjs
	fi
	python scripts/generate_compatibility_dashboard.py --check
	python scripts/benchmark_runtime.py --check
	python -m compileall -q examples
	python scripts/validate_coverage.py coverage.json
	if command -v bandit >/dev/null 2>&1; then
	bandit -q -r lib/python/base_cli scripts -lll -iii
	fi

The quality job repeats most of those invariant gates, Debian, Fedora, and WSL repeat the aggregate again, and the Package workflow repeats it on each main push. A single source change can therefore execute the same platform-independent checks roughly twenty times, increasing runner cost, feedback latency, and exposure to noisy benchmark failures without adding equivalent coverage.

Scope

• Split the authoritative aggregate into composable, named gate groups.
• Run platform/Python-sensitive runtime tests on the compatibility matrix.
• Run invariant typing, lint, docs, schemas, generated-file drift, security, and benchmark jobs once in their supported environment.
• Reuse reviewed artifacts/results across Package and downstream jobs where trust boundaries permit.
• Keep one local aggregate command that invokes all groups.

Acceptance criteria

• Every current gate remains required exactly where its assumptions are supported.
• The Python/OS matrix still catches version- and platform-specific behavior.
• Invariant gates execute once per revision unless explicitly justified.
• Package publication depends on the same reviewed test/security results or reruns only the documented release-boundary checks.
• Workflow summaries expose which gate group supplied each required status.
• Hosted compute time and median feedback latency are measured before and after.

Validation

Compare the old/new required-check graph, inject failures into each gate group, and confirm no matrix/release coverage is lost.

Non-goals

Do not reduce supported Python/OS coverage or weaken release isolation.

Project fields

• Status: Backlog
• Priority: P2
• Area: CI
• Initiative: Adoption Polish
• Size: L

Ownership

• Assignee: @codeforester