ci: accelerate selective verification

Author: altaywtf

.github/verification-paths.yml

@@ -0,0 +1,11 @@
+product:
+  - ".github/**"
+  - ".releaserc.json"
+  - "Makefile"
+  - "Package.swift"
+  - "Sources/**"
+  - "SlopwakeApp/**"
+  - "Tests/**"
+  - "VERSION"
+  - "project.yml"
+  - "scripts/**"

.github/workflows/ci.yml

@@ -14,8 +14,44 @@ on:
 permissions: {}
 
 jobs:
-  verify:
+  changes:
     if: ${{ github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      product: ${{ steps.filter.outputs.product }}
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          filters: .github/verification-paths.yml
+
+  verify-contract:
+    if: ${{ github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Verify release contract
+        run: make release-check
+
+  verify-product:
+    needs: [changes]
+    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.product == 'true' }}
     runs-on: macos-26
     timeout-minutes: 20
     permissions:
@@ -33,7 +69,25 @@ jobs:
         run: sudo xcode-select --switch /Applications/Xcode_26.6.app/Contents/Developer
 
       - name: Verify
-        run: make verify
+        run: make verify-product-lanes -j3
+
+  verify:
+    needs: [verify-contract, verify-product]
+    if: ${{ always() && (github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]')) }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Require selected verification
+        env:
+          CONTRACT_RESULT: ${{ needs.verify-contract.result }}
+          PRODUCT_RESULT: ${{ needs.verify-product.result }}
+        run: |
+          test "${CONTRACT_RESULT}" = success
+          case "${PRODUCT_RESULT}" in
+            success|skipped) ;;
+            *) exit 1 ;;
+          esac
 
   release:
     needs: [verify]

AGENTS.md

@@ -3,7 +3,8 @@
 ## Start
 
 - Require macOS 26+ and Xcode 26+.
-- Run `make verify` before handing off a completed change.
+- Run `make release-check` for docs-only changes. Run `make verify` for product,
+  build, installer, release, or CI changes before handoff.
 - Treat `project.yml` as canonical; `Slopwake.xcodeproj` is generated.
 
 ## Boundaries

Makefile

@@ -3,8 +3,11 @@ SHELL := /bin/bash
 HOST_ARCH := $(shell uname -m)
 RELEASE_VERSION ?= $(shell sed -n '1p' VERSION)
 BUILD_NUMBER ?= 1
+VERIFY_JOBS ?= 4
+TEST_DERIVED_DATA ?= DerivedData/Test
+BUILD_DERIVED_DATA ?= DerivedData/Build
 
-.PHONY: project test core-test app-test release-check build verify release clean
+.PHONY: project test core-test app-test release-check build verify verify-lanes verify-product-lanes release clean
 
 project:
 	./scripts/generate-project.sh
@@ -20,7 +23,7 @@ app-test: project
 		-scheme Slopwake \
 		-configuration Debug \
 		-destination 'platform=macOS,arch=$(HOST_ARCH)' \
-		-derivedDataPath DerivedData \
+		-derivedDataPath $(TEST_DERIVED_DATA) \
 		CODE_SIGN_IDENTITY=- \
 		ONLY_ACTIVE_ARCH=YES \
 		ARCHS=$(HOST_ARCH) \
@@ -35,7 +38,7 @@ build: project
 		-scheme Slopwake \
 		-configuration Release \
 		-destination 'generic/platform=macOS' \
-		-derivedDataPath DerivedData \
+		-derivedDataPath $(BUILD_DERIVED_DATA) \
 		CODE_SIGNING_ALLOWED=NO \
 		MARKETING_VERSION=$(RELEASE_VERSION) \
 		CURRENT_PROJECT_VERSION=$(BUILD_NUMBER) \
@@ -44,7 +47,12 @@ build: project
 release: build
 	RELEASE_VERSION=$(RELEASE_VERSION) ./scripts/release.sh
 
-verify: test release-check build
+verify:
+	+$(MAKE) --no-print-directory -j$(VERIFY_JOBS) verify-lanes
+
+verify-lanes: verify-product-lanes release-check
+
+verify-product-lanes: core-test app-test build
 
 clean:
 	swift package clean