ci: benchmark consolidated hosted gates

.github/workflows/ci.yml

@@ -14,6 +14,7 @@ on:
         options:
           - serial-reference
           - larger-runner-benchmark
+          - consolidated-runner-benchmark
           - optimized-larger-runners
 
 concurrency:
@@ -713,6 +714,153 @@ jobs:
         if: matrix.platform == 'windows'
         run: pnpm run docs:build
 
+  # Manual comparison of the intended low-fanout topology. Linux runs the
+  # complete unsharded primary aggregate with bounded in-runner parallelism;
+  # Windows runs both blocking build surfaces concurrently through run-gates.
+  consolidated-runner-benchmark:
+    if: github.event_name == 'workflow_dispatch' && inputs.suite == 'consolidated-runner-benchmark'
+    name: consolidated / ${{ matrix.platform }} / ${{ matrix.cores }} cores
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      max-parallel: 12
+      matrix:
+        include:
+          - platform: linux
+            cores: '4'
+            runner: dsh-ubuntu-24-04-4core
+            workers: '4'
+          - platform: linux
+            cores: '8'
+            runner: dsh-ubuntu-24-04-8core
+            workers: '8'
+          - platform: linux
+            cores: '16'
+            runner: dsh-ubuntu-24-04-16core
+            workers: '16'
+          - platform: linux
+            cores: '32'
+            runner: dsh-ubuntu-24-04-32core
+            workers: '32'
+          - platform: linux
+            cores: '64'
+            runner: dsh-ubuntu-24-04-64core
+            workers: '32'
+          - platform: linux
+            cores: '96'
+            runner: dsh-ubuntu-24-04-96core
+            workers: '32'
+          - platform: windows
+            cores: '4'
+            runner: dsh-windows-2025-4core
+            workers: '2'
+          - platform: windows
+            cores: '8'
+            runner: dsh-windows-2025-8core
+            workers: '2'
+          - platform: windows
+            cores: '16'
+            runner: dsh-windows-2025-16core
+            workers: '2'
+          - platform: windows
+            cores: '32'
+            runner: dsh-windows-2025-32core
+            workers: '2'
+          - platform: windows
+            cores: '64'
+            runner: dsh-windows-2025-64core
+            workers: '2'
+          - platform: windows
+            cores: '96'
+            runner: dsh-windows-2025-96core
+            workers: '2'
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.PRIMARY_NODE_VERSION }}
+
+      - name: Report runner capacity
+        run: >-
+          node -e "const os = require('node:os');
+          console.log(JSON.stringify({ arch: process.arch, cpus: os.cpus().length,
+          memoryGiB: Math.round(os.totalmem() / 2 ** 30) }))"
+
+      - name: Enable corepack (pnpm)
+        run: corepack enable
+
+      - name: Resolve pnpm store path (Linux)
+        if: matrix.platform == 'linux'
+        id: pnpm-store-linux
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Resolve pnpm store path (Windows)
+        if: matrix.platform == 'windows'
+        id: pnpm-store-windows
+        shell: pwsh
+        run: '"path=$(pnpm store path --silent)" >> $env:GITHUB_OUTPUT'
+
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-store-linux.outputs.path || steps.pnpm-store-windows.outputs.path }}
+          key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-
+
+      - uses: actions/cache@v4
+        if: matrix.platform == 'linux'
+        with:
+          path: .cache/eslint
+          key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-eslint-full-${{ hashFiles('pnpm-lock.yaml', 'eslint.config.mjs', 'tsconfig.json', 'packages/*/*/tsconfig.json', 'examples/*/tsconfig.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-eslint-full-
+
+      - name: Install and prepare Linux
+        if: matrix.platform == 'linux'
+        run: |
+          pnpm install --frozen-lockfile &
+          install_pid=$!
+          (
+            if ! sudo apt-get install -yq --no-install-recommends bubblewrap; then
+              echo "initial bubblewrap install failed; refreshing APT indexes and retrying"
+              sudo apt-get update -q
+              sudo apt-get install -yq --no-install-recommends bubblewrap
+            fi
+            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 \
+              || echo "apparmor userns knob absent — the functional probe decides"
+          ) &
+          sandbox_pid=$!
+          install_status=0
+          wait "$install_pid" || install_status=$?
+          sandbox_status=0
+          wait "$sandbox_pid" || sandbox_status=$?
+          if (( install_status != 0 )); then exit "$install_status"; fi
+          exit "$sandbox_status"
+
+      - name: Install (immutable)
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        run: pnpm install --frozen-lockfile
+
+      - name: Run complete unsharded primary Node CI concurrently
+        if: matrix.platform == 'linux'
+        env:
+          DSH_COVERAGE_MAX_WORKERS: ${{ matrix.workers }}
+          DSH_ESLINT_CACHE: '1'
+          DSH_GATE_CONCURRENCY: ${{ matrix.workers }}
+          DSH_PUBLINT_CONCURRENCY: ${{ matrix.workers }}
+          DSH_SNAPSHOT_MAX_CONCURRENCY: ${{ matrix.workers }}
+        run: pnpm run check:ci
+
+      - name: Run blocking Windows builds concurrently
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        env:
+          DSH_GATE_CONCURRENCY: ${{ matrix.workers }}
+        run: pnpm run check:ci:windows-blocking
+
   # Single stable required check for branch protection: require "all checks
   # passed" instead of enumerating matrix legs whose names change as lanes and
   # node versions evolve. Every blocking job in THIS workflow must be listed in

package.json

@@ -31,6 +31,8 @@
     "check:ci:coverage": "tsx scripts/run-gates.ts ci-coverage",
     "check:ci:snapshot": "tsx scripts/run-gates.ts ci-snapshot",
     "check:ci:artifacts": "tsx scripts/run-gates.ts ci-artifacts",
+    "check:ci:windows-blocking": "tsx scripts/run-gates.ts ci-windows-blocking",
+    "check:ci:windows-observational": "tsx scripts/run-gates.ts ci-windows-observational",
     "check:node-compat": "tsx scripts/run-gates.ts node-compat",
     "check:pre-push": "tsx scripts/run-gates.ts pre-push",
     "knip": "knip --treat-config-hints-as-errors",

scripts/run-gates.ts

@@ -20,6 +20,8 @@ type Mode =
   | 'ci-coverage'
   | 'ci-snapshot'
   | 'ci-artifacts'
+  | 'ci-windows-blocking'
+  | 'ci-windows-observational'
   | 'node-compat'
   | 'pre-push'
   | 'doc-sync'
@@ -90,13 +92,15 @@ function parseMode(raw: string | undefined): Mode {
     case 'ci-coverage':
     case 'ci-snapshot':
     case 'ci-artifacts':
+    case 'ci-windows-blocking':
+    case 'ci-windows-observational':
     case 'node-compat':
     case 'pre-push':
     case 'doc-sync':
       return raw
     default:
       throw new Error(
-        `run-gates: expected mode ci-primary | ci-static | ci-lint | ci-coverage | ci-snapshot | ci-artifacts | node-compat | pre-push | doc-sync, got ${JSON.stringify(raw)}.`,
+        `run-gates: expected mode ci-primary | ci-static | ci-lint | ci-coverage | ci-snapshot | ci-artifacts | ci-windows-blocking | ci-windows-observational | node-compat | pre-push | doc-sync, got ${JSON.stringify(raw)}.`,
       )
   }
 }
@@ -179,6 +183,10 @@ function gatesForMode(selected: Mode): Gate[] {
         : [pnpmScript('build', 'build'), snapshotGate()]
     case 'ci-artifacts':
       return ciArtifactGates()
+    case 'ci-windows-blocking':
+      return ciWindowsBlockingGates()
+    case 'ci-windows-observational':
+      return ciWindowsObservationalGates()
     case 'node-compat':
       return [
         ...flagEnabled('DSH_NODE_COMPAT_SKIP_TYPECHECK') ? [] : [pnpmScript('typecheck', 'typecheck')],
@@ -275,6 +283,28 @@ function ciArtifactGates(): Gate[] {
   return [...metadataGates, builtBinSmokeGate()]
 }
 
+function ciWindowsBlockingGates(): Gate[] {
+  return [
+    pnpmScript('windows-build', 'build', { label: 'build' }),
+    pnpmScript('windows-site', 'docs:build', { label: 'production site' }),
+  ]
+}
+
+function ciWindowsObservationalGates(): Gate[] {
+  return [
+    ...ciStaticGates(),
+    lintGate(),
+    pnpmScript('duplication', 'duplication'),
+    pnpmScript('publint', 'publint', { needs: ['build'] }),
+    pnpmScript('node-next-types', 'verify-node-next-types', {
+      label: 'node-next types',
+      needs: ['build'],
+    }),
+    builtPackageInvariantsGate(['build']),
+    builtBinSmokeGate(),
+  ]
+}
+
 function lintGate(eslintTargets: readonly string[] = ['.']): Gate {
   if (process.env.DSH_ESLINT_CACHE === '1') {
     return pnpmExec('lint', [