ci: group test checks into state-machine and sink trees

joshua-temple · joshua-temple · commit 0247ddcdd890 · 2026-06-03T10:00:27.000-04:00
Signed-off-by: Joshua Temple &lt;joshua.temple@stablekernel.com&gt;
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -132,16 +132,26 @@ jobs:
         working-directory: sink/slog
         run: go run "$GOLANGCI_LINT" run --config "$GITHUB_WORKSPACE/.golangci.yml" ./...
 
-  # The race-test matrix lives in a reusable workflow so its legs render as a
-  # single collapsible tree in the checks UI ("tests / test (1.25.11, …)") rather
-  # than as flat top-level checks. Keep the module list in sync with the lint,
-  # vuln, and coverage jobs below.
+  # The state-machine race-test matrix lives in a reusable workflow so its legs
+  # render as a single collapsible "state machine tests / …" tree in the checks
+  # UI rather than as flat top-level checks. The sink-domain legs live in their
+  # own "sink" tree (see the `sink` job below). Keep this module list in sync
+  # with the lint, vuln, and coverage jobs below.
   tests:
+    name: state machine tests
     needs: changes
     if: needs.changes.outputs.code == 'true'
     uses: ./.github/workflows/test.yml
     with:
-      modules: "state state/expr durable cluster transport wasm e2e examples/fooddelivery examples/dispatch telemetry telemetry/slog telemetry/otel telemetry/datadog sink sink/bridge sink/file sink/http sink/prometheus sink/slog"
+      modules: "state state/expr durable cluster transport wasm e2e examples/fooddelivery examples/dispatch telemetry telemetry/slog telemetry/otel telemetry/datadog"
+
+  # Every sink-domain check (in-workspace race tests, the SDK-backed destination
+  # matrix, and the integration leg) groups under a single collapsible "sink / …"
+  # tree via this reusable workflow.
+  sink:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
+    uses: ./.github/workflows/sink.yml
 
   vuln:
     needs: changes
@@ -532,115 +542,6 @@ jobs:
       - name: Build site
         run: npm run build
 
-  # The SDK-backed sink destinations are standalone modules kept out of the
-  # workspace (see go.work / the magefile), so they build with GOWORK=off via
-  # their own replace directives. Each is one matrix leg across the OS matrix for
-  # race tests; lint, vuln, and the coverage gate run on Linux. This keeps the
-  # vendor SDKs out of the core modules' dependency graphs.
-  sink-destinations:
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        module:
-          - sink/cloudwatch
-          - sink/dynamo
-          - sink/eventbridge
-          - sink/firehose
-          - sink/gcppubsub
-          - sink/kafka
-          - sink/kinesis
-          - sink/nats
-          - sink/otel
-          - sink/redis
-          - sink/s3
-          - sink/sns
-          - sink/sql
-          - sink/sqs
-          - sink/statsd
-          - sink/timestream
-          - examples/sinkflow
-    runs-on: ${{ matrix.os }}
-    env:
-      GOWORK: "off"
-      THRESHOLD: "80"
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version: "1.26.4"
-          cache-dependency-path: "**/go.sum"
-      - name: test -race
-        shell: bash
-        run: go test -C "${{ matrix.module }}" -race ./...
-      - name: golangci-lint
-        if: matrix.os == 'ubuntu-latest'
-        shell: bash
-        run: go -C "${{ matrix.module }}" run "$GOLANGCI_LINT" run --config "$GITHUB_WORKSPACE/.golangci.yml" ./...
-      - name: govulncheck
-        if: matrix.os == 'ubuntu-latest'
-        shell: bash
-        run: go -C "${{ matrix.module }}" run "$GOVULNCHECK" ./...
-      - name: coverage gate
-        if: matrix.os == 'ubuntu-latest'
-        shell: bash
-        run: |
-          go test -C "${{ matrix.module }}" -covermode=atomic -coverprofile=coverage.out ./...
-          pct=$(go -C "${{ matrix.module }}" tool cover -func=coverage.out | awk '/^total:/ {sub(/%/,"",$3); print $3}')
-          echo "total coverage: ${pct}% (threshold ${THRESHOLD}%)"
-          awk -v p="$pct" -v t="$THRESHOLD" 'BEGIN { exit (p+0 < t+0) ? 1 : 0 }' \
-            || { echo "::error::coverage ${pct}% is below the ${THRESHOLD}% threshold"; exit 1; }
-
-  # Integration / E2E leg, behind the `integration` build tag, run with
-  # GOWORK=off. The hermetic destinations (sql, http, file, slog, prometheus,
-  # statsd, otel) and the flagship sinkflow example run end-to-end; the
-  # container-backed destinations drive a real emulator via testcontainers
-  # (Docker is available on GitHub-hosted ubuntu runners) and skip cleanly if a
-  # daemon is ever absent. Kept off the default test matrix so the hermetic
-  # checks stay fast.
-  integration:
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
-    strategy:
-      fail-fast: false
-      matrix:
-        module:
-          - sink/file
-          - sink/http
-          - sink/prometheus
-          - sink/slog
-          - sink/sql
-          - sink/statsd
-          - sink/otel
-          - sink/cloudwatch
-          - sink/dynamo
-          - sink/eventbridge
-          - sink/firehose
-          - sink/gcppubsub
-          - sink/kafka
-          - sink/kinesis
-          - sink/nats
-          - sink/redis
-          - sink/s3
-          - sink/sns
-          - sink/sqs
-          - sink/timestream
-          - examples/sinkflow
-    runs-on: ubuntu-latest
-    env:
-      GOWORK: "off"
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version: "1.26.4"
-          cache-dependency-path: "**/go.sum"
-      - name: integration tests
-        shell: bash
-        run: go test -C "${{ matrix.module }}" -tags integration ./...
-
   # Single required status check. Branch protection requires only `gate`, which
   # aggregates the required jobs: it fails if any of them failed or was
   # cancelled, and treats a skipped job (docs-only PRs, or PRs that touch no
@@ -649,7 +550,7 @@ jobs:
   # never blocks a merge.
   gate:
     if: always()
-    needs: [changes, lint, tests, vuln, coverage, docs, sink-destinations, integration]
+    needs: [changes, lint, tests, sink, vuln, coverage, docs]
     runs-on: ubuntu-latest
     steps:
       - name: Fail if a required job did not pass
diff --git a/.github/workflows/sink.yml b/.github/workflows/sink.yml
@@ -0,0 +1,152 @@
+name: sink
+
+# Reusable sink test suite. Groups every sink-domain check under a single
+# collapsible "sink / …" tree in the checks UI rather than sprawling across the
+# top-level check list:
+#   - unit:              race tests for the in-workspace sink modules (Go × OS).
+#   - sink-destinations: the SDK-backed destinations, built GOWORK=off via their
+#                        own replace directives, with lint/vuln/coverage on Linux.
+#   - integration:       the `integration`-tagged end-to-end leg (GOWORK=off).
+# Called by ci.yml so the caller job name ("sink") becomes the tree prefix.
+on:
+  workflow_call:
+
+env:
+  GOLANGCI_LINT: github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
+  GOVULNCHECK: golang.org/x/vuln/cmd/govulncheck@v1.3.0
+
+permissions:
+  contents: read
+
+jobs:
+  # Race tests for the in-workspace sink modules (sink core + the hermetic,
+  # SDK-free adapters), across the Go × OS matrix. These live in the workspace,
+  # so they build without GOWORK=off — same as the state-machine unit matrix.
+  unit:
+    strategy:
+      fail-fast: false
+      matrix:
+        go: ["1.25.11", "1.26.4"]
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    env:
+      MODULES: "sink sink/bridge sink/file sink/http sink/prometheus sink/slog"
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ matrix.go }}
+          cache-dependency-path: "**/go.sum"
+      - name: test -race
+        shell: bash
+        run: |
+          for module in $MODULES; do
+            echo "::group::test -race ($module)"
+            go test -C "$module" -race ./...
+            echo "::endgroup::"
+          done
+
+  # The SDK-backed sink destinations are standalone modules kept out of the
+  # workspace (see go.work / the magefile), so they build with GOWORK=off via
+  # their own replace directives. Each is one matrix leg across the OS matrix for
+  # race tests; lint, vuln, and the coverage gate run on Linux. This keeps the
+  # vendor SDKs out of the core modules' dependency graphs.
+  sink-destinations:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        module:
+          - sink/cloudwatch
+          - sink/dynamo
+          - sink/eventbridge
+          - sink/firehose
+          - sink/gcppubsub
+          - sink/kafka
+          - sink/kinesis
+          - sink/nats
+          - sink/otel
+          - sink/redis
+          - sink/s3
+          - sink/sns
+          - sink/sql
+          - sink/sqs
+          - sink/statsd
+          - sink/timestream
+          - examples/sinkflow
+    runs-on: ${{ matrix.os }}
+    env:
+      GOWORK: "off"
+      THRESHOLD: "80"
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "1.26.4"
+          cache-dependency-path: "**/go.sum"
+      - name: test -race
+        shell: bash
+        run: go test -C "${{ matrix.module }}" -race ./...
+      - name: golangci-lint
+        if: matrix.os == 'ubuntu-latest'
+        shell: bash
+        run: go -C "${{ matrix.module }}" run "$GOLANGCI_LINT" run --config "$GITHUB_WORKSPACE/.golangci.yml" ./...
+      - name: govulncheck
+        if: matrix.os == 'ubuntu-latest'
+        shell: bash
+        run: go -C "${{ matrix.module }}" run "$GOVULNCHECK" ./...
+      - name: coverage gate
+        if: matrix.os == 'ubuntu-latest'
+        shell: bash
+        run: |
+          go test -C "${{ matrix.module }}" -covermode=atomic -coverprofile=coverage.out ./...
+          pct=$(go -C "${{ matrix.module }}" tool cover -func=coverage.out | awk '/^total:/ {sub(/%/,"",$3); print $3}')
+          echo "total coverage: ${pct}% (threshold ${THRESHOLD}%)"
+          awk -v p="$pct" -v t="$THRESHOLD" 'BEGIN { exit (p+0 < t+0) ? 1 : 0 }' \
+            || { echo "::error::coverage ${pct}% is below the ${THRESHOLD}% threshold"; exit 1; }
+
+  # Integration / E2E leg, behind the `integration` build tag, run with
+  # GOWORK=off. The hermetic destinations (sql, http, file, slog, prometheus,
+  # statsd, otel) and the flagship sinkflow example run end-to-end; the
+  # container-backed destinations drive a real emulator via testcontainers
+  # (Docker is available on GitHub-hosted ubuntu runners) and skip cleanly if a
+  # daemon is ever absent. Kept off the default test matrix so the hermetic
+  # checks stay fast.
+  integration:
+    strategy:
+      fail-fast: false
+      matrix:
+        module:
+          - sink/file
+          - sink/http
+          - sink/prometheus
+          - sink/slog
+          - sink/sql
+          - sink/statsd
+          - sink/otel
+          - sink/cloudwatch
+          - sink/dynamo
+          - sink/eventbridge
+          - sink/firehose
+          - sink/gcppubsub
+          - sink/kafka
+          - sink/kinesis
+          - sink/nats
+          - sink/redis
+          - sink/s3
+          - sink/sns
+          - sink/sqs
+          - sink/timestream
+          - examples/sinkflow
+    runs-on: ubuntu-latest
+    env:
+      GOWORK: "off"
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "1.26.4"
+          cache-dependency-path: "**/go.sum"
+      - name: integration tests
+        shell: bash
+        run: go test -C "${{ matrix.module }}" -tags integration ./...
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -1,9 +1,10 @@
 name: tests
 
-# Reusable race-test matrix. Runs `go test -race ./...` for every module in the
-# suite across the Go × OS matrix. Called by ci.yml so the matrix legs render as
-# a single collapsible tree in the checks UI (e.g. "tests / test (1.25.11,
-# ubuntu-latest)") instead of cluttering the top-level checks list.
+# Reusable race-test matrix for the state-machine modules. Runs `go test -race
+# ./...` for each module across the Go × OS matrix. Called by ci.yml so the legs
+# render as a single collapsible tree in the checks UI (e.g. "state machine tests
+# / test (1.25.11, ubuntu-latest)") instead of cluttering the top-level checks
+# list. The sink-domain modules have their own reusable workflow (sink.yml).
 on:
   workflow_call:
     inputs:
