ci: split the pipeline into path-filtered suites

[kartikeya-27]

Every PR currently runs the whole pipeline. The lint job alone installs the Rust toolchain, uv, pnpm and Node and does a full pnpm install — even for a PR that only touches crates/. This restructures ci.yml into an orchestrator that runs only what a change can affect.

Structure follows the pattern in taskito: a changes job, reusable per-suite workflows, and a single aggregating status check.

Layout

.github/
  actions/
    setup-rust/      toolchain + cargo cache
    setup-python/    python + uv (+ optional dev sync)
    setup-node/      pnpm + node + docs install
    pre-commit/      cached pre-commit run, SKIP-scoped
    verify-sdist/    (existing)
  workflows/
    ci.yml           orchestrator: changes -> suites -> CI status
    ci-rust.yml      fmt, clippy, cargo test --workspace
    ci-python.yml    ruff, mypy, pytest matrix
    ci-docs.yml      biome, types
    ci-release.yml   version check, publish dry-run, sdist verify
    actionlint.yml   lints the workflows themselves

Suite	Runs when
Rust	crates/, Cargo manifests
Python	the above, plus dagron/, tests/python/, pyproject.toml
Docs	docs/
Release readiness	anything affecting a published artifact

Python depends on the shared Rust paths on purpose: the bindings are compiled into the wheel, so a crates/ change can break Python at runtime with the Python sources untouched. Docs deliberately does not — it is MDX and TypeScript with no build-time dependency on the workspace.

Pushes to master and workflow_dispatch ignore the filter and run everything, so merged code is always covered in full. Coverage is delayed to merge, never lost.

Lint hooks stay single-source

Rather than reimplementing ruff/mypy/clippy invocations in CI — which would let CI drift from .pre-commit-config.yaml, since the hook revs differ from the versions in the dev group — each suite runs pre-commit with a SKIP list of the hooks it does not own.

SKIP is an exclusion rather than an inclusion deliberately: a newly added hook runs in every suite until someone skips it. That fails loudly, where an inclusion list would silently leave it unchecked.

Verified each hook lands in exactly one suite, with the union covering all seven:

Rust    SKIP=ruff-check,ruff-format,mypy,docs-biome,docs-types  -> cargo fmt, clippy
Python  SKIP=cargo-fmt,clippy,docs-biome,docs-types             -> ruff check, ruff format, mypy
Docs    SKIP=ruff-check,ruff-format,mypy,cargo-fmt,clippy       -> docs biome, docs types

Also drops the standalone cargo fmt --all --check step, which duplicated the cargo-fmt hook.

CI status

Every suite is skippable, and a skipped job reports nothing to branch protection — so the suites cannot be required checks individually. CI status always runs and fails if anything it needs did not succeed or skip.

Branch protection needs updating to require CI status instead of the old per-job checks, otherwise protection silently passes on a PR where a suite failed.

Matrix

The Python matrix is trimmed on PRs to Linux on both versions plus one Windows cell — Windows is where the platform-specific failures have actually been (#18). The full 3×2 still runs on every push to master. Flagging it since it is a deliberate coverage-vs-latency trade; happy to keep the full matrix on PRs if you would rather.

Verification

• actionlint clean across all workflows and composite actions (run locally at v1.7.12). It also surfaced a pre-existing SC2162 in cleanup.yml, fixed here, which would otherwise have failed the new job on its first run.
• Each suite's SKIP scoping exercised locally — output above.
• dorny/paths-filter@v4 and raven-actions/actionlint@v2 confirmed to resolve.

[coderabbitai]

Warning

Review limit reached

@kartikeya-27, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 26 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ef06443a-6376-4194-bea4-cf49718af140

📥 Commits

Reviewing files that changed from the base of the PR and between 49ece3b and cb8af8b.

📒 Files selected for processing (13)

• .github/actions/pre-commit/action.yml
• .github/actions/setup-node/action.yml
• .github/actions/setup-python/action.yml
• .github/actions/setup-rust/action.yml
• .github/workflows/actionlint.yml
• .github/workflows/ci-docs.yml
• .github/workflows/ci-python.yml
• .github/workflows/ci-release.yml
• .github/workflows/ci-rust.yml
• .github/workflows/ci.yml
• .github/workflows/cleanup.yml
• CHANGELOG.md
• CONTRIBUTING.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}