Run change-selective CI with four-hour full regression

[alexeygrigorev]

Outcome

Main-push CI keeps its existing release, quality, browser, image, and serialized deployment safety gates, but replaces the unconditional full Django test invocation with a deterministic application-aware selection. A push whose complete diff is safely owned by one mapped application runs that application's reviewed test closure; shared, cross-application, migration, dependency, configuration, workflow, deployment, template/static, testless, unknown, or malformed changes run the full existing suite.

A separate scheduled workflow starts every four hours and runs that complete suite only when the scheduled main SHA has not already passed a successful scheduled full regression. It retries the same SHA after any unsuccessful scheduled run, runs when no successful full-regression anchor exists, and fails open to testing (never to skipping) when GitHub history cannot be interpreted safely.

This is CI orchestration only. It does not change Django admin, Studio, public behavior, application code, test assertions, deployment behavior, or HTML templates.

Product and architecture authority

• _docs/PROCESS.md: engineer/tester/PM lifecycle and no commit before acceptance.
• _docs/architecture/app-boundaries.md: one Django deployment, application ownership, shared services, and cross-application boundaries.
• _docs/specs/10-verification-strategy.md: deterministic verification, ordinary-CI SQLite, core browser checks, and deployment verification.
• Exact reviewed website main baseline: 872fd8a9145a0e29de8890e9ea3e9d8df8c63cfd.

The reviewed workflow currently has push and workflow_dispatch controllers; immutable release resolution; full quality; make test; core Playwright; container verification; serialized prior-capture/publish/deploy jobs; and separate manual probe jobs. The current make test runs compatibility pytest and every Django test. Ordinary CI creates a fresh SQLite database, while deployment-check only validates production configuration and must not connect to PostgreSQL.

GitHub's documented event model is part of the design:

• a push payload supplies exact before and after commit identifiers (push webhook payload);
• scheduled workflows run the latest default-branch commit associated with that schedule event, use UTC by default, can be delayed, and require the workflow on the default branch (events that trigger workflows);
• workflow_dispatch also requires the workflow file on the default branch (triggering a workflow);
• prior runs can be filtered by workflow, branch, and event, and their jobs can be inspected with Actions read permission (workflow-runs API, workflow-jobs API); and
• workflow/job token permissions and concurrency are explicitly configurable (workflow permissions, concurrency behavior).

Normal CI change selection

Exact source range

For push to main:

1. HEAD is the immutable release SHA already validated by resolve-release; it must equal both github.sha and github.event.after and be exactly 40 lowercase hexadecimal characters.
2. BASE is exactly github.event.before; do not derive it from HEAD^, the webhook commits array, a merge base, the last successful workflow, or a path-filter action.
3. Checkout/fetch full history. Both commits must resolve exactly, and BASE must be an ancestor of HEAD.
4. Enumerate the complete range with a NUL-delimited, rename/copy-aware Git diff equivalent to git diff --name-status -z --find-renames --find-copies BASE HEAD. For rename/copy records, classify both the old and new paths. Deletions are classified by their old path.
5. An all-zero, missing, malformed, unfetchable, non-commit, non-ancestor/force-push base; a mismatched head; an empty/failed/unparseable diff; an unsupported status/mode; or any path that cannot be classified selects full with a stable fallback reason. It must never produce a successful no-test decision.

For a non-probe workflow_dispatch, there is no authoritative push base. The selected exact reachable release_sha therefore always uses profile=full, reason=manual_dispatch; no guessed diff is allowed. Existing operation=probe validation and probe-only jobs remain unchanged and do not enter this selector.

The classifier is code-owned and committed, not an inline shell expression. It emits schema-versioned JSON containing event, base, head, changed-path count, application roots, profile, sorted unique test labels, and stable reason code. Filenames are parsed NUL-safely. Test labels come only from a closed allowlist; no filename or user input is evaluated or interpolated as shell code.

Selection precedence and exact map

Force-full rules are evaluated before the application map. A focused profile is permitted only when every changed path belongs to the same mapped root, no force-full rule matches, every changed object is an ordinary tracked file, and the resulting labels validate against the allowlist. A diff spanning two or more application roots is cross-application and selects full even if every individual root is mapped.

For one safely owned application root, use this exact Django-label closure. Multiple changed files within that one root use the row once.

Changed root	Sorted Django labels
api/**	api
cadmin/**	cadmin
content/**	accounts content.tests core
courses/**	accounts api cadmin content.tests core courses data
data/**	api cadmin courses data
jobs/**	jobs
management_api/**	api management_api
management_auth/**	api core management_api management_auth
review_import/**	accounts review_import
studio/**	accounts core studio

These closures cover the directly observed consumers at the reviewed baseline; they are deliberately broader than only the owning label. Updating the map or its allowlist is itself a force-full workflow/configuration change.

The following select full before that table is considered:

• any **/migrations/**, **/templates/**, **/static/**, or HTML/template file;
• accounts/** and core/**, because identity/authentication and shared primitives/configuration are deployment-wide;
• content_sync/**, email_app/**, and events/**, because they have no owned test label at the reviewed baseline;
• website/**, course_management/**, course_platform_templates/**, templates/**, compatibility/**, playwright_tests/**, e2e/**, deploy/**, scripts/**, .github/**, and .claude/**;
• manage.py, Makefile, Dockerfile, pyproject.toml, uv.lock, .python-version, repository-root configuration, and dependency/tool lock files;
• _docs/**, AGENTS.md, README.md, generated/checked contracts, fixtures outside a mapped root, symlinks/submodules/type changes, and every other unmatched path.

This default is intentionally conservative. New applications, directories, file kinds, generated contracts, or cross-application exceptions receive the full suite until an independently reviewed issue extends the map and its tests.

Workflow execution and deployment gate

For every non-probe main push and manual release:

• preserve uv sync --locked, uv lock --check, and every existing quality command;
• create/migrate a fresh ordinary-CI SQLite database exactly as today; do not add a PostgreSQL service or connection;
• for profile=focused, invoke one new uv-backed Make target that validates the classifier JSON and runs one Django test process with exactly the sorted labels above;
• for profile=full, keep make test, including compatibility pytest and all Django tests;
• always retain the current core Playwright job and exact-image container verification/reuse rules; and
• do not delete, weaken, quarantine, or silently ignore any test to make selection pass.

Add one ci-gate aggregation job with if: always() for the non-probe path. It validates the classifier schema/reason and requires successful release resolution, classification, quality, selected/full Django, core Playwright, and container outcomes. A skipped/cancelled/neutral/timed-out required job fails the gate; the only accepted test bypass is the existing separately validated manual probe operation.

auto-capture-prior, publish, and deploy must depend on the successful aggregate gate plus their existing data/image prerequisites rather than reconstructing conditional success independently. Preserve exact source/image coherence checks, current input semantics, job-level AWS id-token: write only where already required, and the existing workflow concurrency group website-development-release with cancel-in-progress: false. A focused selection must never allow deployment after a failed or missing required check.

Four-hour scheduled full regression

Create a separate workflow with:

• on.schedule.cron: "17 */4 * * *" (UTC, deliberately away from the hour boundary);
• exact scheduled source github.sha, validated as a 40-character commit and checked out exactly; this is the main commit GitHub associated with that schedule event;
• concurrency group website-scheduled-full-regression, cancel-in-progress: false, and queue: max, so a running or pending scheduled check is not cancelled by the next tick;
• workflow permissions only contents: read and actions: read; no id-token, AWS role, environment secret, package write, issue write, or repository-content write permission; and
• no publish, prior-release capture, deploy, probe, production/RDS, live E2E, or AWS job.

The scheduled selector inspects completed runs of this workflow only, event=schedule, branch=main, excluding the current run. It requests up to 100 prior runs and the latest-attempt jobs for each candidate through the documented REST APIs. It records neither a repository variable nor a commit; workflow/job history is the source of truth.

Decision algorithm, in order:

1. If history/API data is unavailable, incomplete, malformed, over the bounded search without a usable anchor, or otherwise ambiguous, run full with reason=history_unavailable or reason=no_coverage_anchor.
2. If there is no prior completed scheduled run, run full with reason=first_scheduled_run.
3. If the immediately previous completed scheduled run has any conclusion other than success, run full with reason=retry_after_<conclusion>, even when its SHA or an older coverage SHA equals the current SHA.
4. Search newest-to-oldest for the latest scheduled run whose workflow conclusion is success and whose latest-attempt job with the fixed job id/name full-regression concluded success. A successful selector-only run where full-regression was skipped is not a coverage anchor.
5. If that anchor's exact head_sha differs from the current scheduled SHA, run full with reason=sha_changed.
6. Only when the anchor exists, its full job succeeded, the immediately previous run succeeded, and its head_sha equals the current scheduled SHA may the full job skip with reason=already_successfully_covered.

When selected, full-regression runs the same complete non-deployment verification as full main CI: locked uv environment/lock check, all current quality commands, fresh SQLite migration, make test, make test-playwright-core, and current container build/runtime/static/liveness checks. It may be split into jobs for parallelism, but a fixed final full-regression marker job succeeds only after every component succeeds; that marker is the sole future coverage anchor.

An always-running scheduled summary/gate reports the decision and succeeds on an intentional unchanged-SHA skip, but it fails when a selected full component fails. A failed selected run never advances coverage and therefore forces the next scheduled tick to test the unchanged SHA again.

Observability and safe evidence

Both selectors write a concise Actions step summary and a machine-readable JSON artifact. Normal CI reports base/head, profile, stable reason, application root, changed-path count, selected labels, and required job outcomes. Scheduled CI reports current SHA, decision/reason, previous scheduled run id/conclusion, coverage-anchor run id/SHA, history depth inspected, and full component outcomes.

Do not print API tokens, headers, environment secrets, release records, production data, or raw API responses. Repository filenames are untrusted: JSON-encode artifacts and HTML/Markdown-escape plus bound any displayed filename/reason so crafted paths cannot inject Actions-summary markup. An intentional scheduled skip must be visible as already_successfully_covered, not as an unexplained absent job.

Explicit non-goals

• Changing application behavior, Django admin, Studio, the admin API, API-token generation, authorization, models, migrations, fixtures, or test expectations.
• Editing, reformatting, compacting, minifying, or generating HTML templates; the candidate's template diff must be empty.
• Predicting individual tests inside an application, parallelizing/sharding test cases, or extending selection beyond the exact table.
• Making scheduled CI publish or deploy, changing AWS infrastructure/roles, adding secrets, using production data, or adding PostgreSQL to ordinary CI.
• Changing the current manual probe contract, automatic-deploy enablement variable, immutable image/source checks, release inputs, deployment ordering, or rollback/promotion behavior except to consume the aggregate CI gate.
• Treating a successful unchanged-SHA selector-only run as full-regression coverage.

Acceptance criteria

• Push selection uses exact validated github.event.before → resolved github.event.after/github.sha, a full-history NUL-safe rename/copy-aware diff, both paths of rename/copy records, and the exact precedence/map above.
• One eligible application root runs exactly its sorted reviewed label closure; a second root or any force-full/unknown/ambiguous input runs make test.
• Zero/malformed/missing/unreachable/non-ancestor bases, head mismatches, empty/failed diff, unsupported records, and classifier/schema errors visibly fall back to full instead of skipping or failing open to deployment.
• Non-probe manual dispatch always runs full; the existing probe path remains separately validated and behaviorally unchanged.
• Focused and full pushes retain locked uv, full quality, fresh SQLite, core Playwright, container verification, immutable release/image checks, aggregate gating, and serialized automatic deployment. No ordinary-CI PostgreSQL connection is added.
• The schedule fires at minute 17 every four UTC hours, is separately serialized/queued, checks the exact scheduled main SHA, and has only contents: read plus actions: read with no AWS/deployment authority.
• First/no-anchor, changed-SHA, previous-failure/cancel/timeout/stale/action-required, bounded-history/API-error, and malformed-history states run full. Only a matching successful full-regression anchor with no later failed run skips.
• A scheduled full failure retries the unchanged SHA at the next tick; a successful full advances the anchor; successful unchanged-SHA skips do not replace that anchor.
• Normal and scheduled aggregate gates cannot report success when a required selected component failed, was cancelled, or was unexpectedly skipped.
• Actions summaries/artifacts expose bounded safe reason/evidence without secrets or unescaped filenames; an unchanged-SHA skip has the exact observable reason already_successfully_covered.
• Classifier, scheduler, workflow-contract, focused/full execution, and deployment-dependency tests pass through uv-backed targets; the candidate changes no HTML template.

Required automated scenarios

1. Table-drive every application-map row and assert exact sorted labels, deduplication, schema, and focused profile for one-root multi-file diffs.
2. Cover two mapped roots; mapped plus unknown; core/accounts/testless apps; migration/template/static/HTML; workflow/deploy/scripts/config/dependency/lock; docs/generated contracts; symlink/submodule/type change; and new unknown root. Every case selects full with its stable reason.
3. Cover add/modify/delete and rename/copy within one root, across roots, and between mapped/force-full paths. Include spaces, tabs, newlines, Unicode, leading dashes, and shell metacharacters in paths; prove NUL-safe parsing, safe summaries, and no command injection.
4. Cover exact push base/head validation, all-zero before, missing commit, shallow/unfetchable history, forced/non-ancestor update, mismatched after/SHA, empty diff, unsupported status, parser error, invalid output/schema, and allowlist rejection. Unsafe cases run full or block the aggregate gate—never a focused/skip deployment.
5. Assert focused Django runs one process with only code-owned labels and full runs the existing make test; both use fresh SQLite. Assert quality, core Playwright, and container remain required in either profile.
6. Table-drive scheduled history: no runs; same/different successful full anchor; intervening successful skips; previous full/selector failure, cancellation, timeout, stale, or action-required; successful re-run latest attempt; skipped/missing/duplicate marker job; current/non-schedule/wrong-workflow/wrong-branch exclusion; pagination boundary; rate/error/malformed response; and no anchor within 100. Verify the exact decision/reason and retry behavior.
7. Workflow-contract tests parse the YAML and assert the four-hour cron, separate queued concurrency, least permissions, exact checkout, fixed marker, absence of AWS/publish/deploy jobs, unchanged release concurrency, aggregate dependencies, full-suite targets, and manual-full/probe behavior.
8. Run the classifier and scheduled selector twice on fixed fixtures and byte-compare JSON. Run the existing full ordinary suite once as parity evidence and demonstrate representative focused, fallback-full, first-schedule, changed-SHA, unchanged-skip, and failed-then-retry summaries.

Tester and handoff evidence

The engineer implements and tests without committing. The independent tester receives the uncommitted candidate and records:

• focused/fallback classifier fixtures and exact labels/reasons;
• full-suite parity and aggregate/deployment dependency results;
• scheduled first/change/skip/failure-retry fixture output and least-permission/concurrency checks;
• ordinary SQLite evidence and absence of a PostgreSQL service/connection;
• git diff --name-only evidence showing no HTML/template changes; and
• safe Actions-summary examples with no secret/raw response data.

This issue has no public-page or template change, so browser screenshots are not applicable. Existing core Playwright must still pass. Store any scratch output only under .tmp/issue-104/; do not expose tokens, release records, production data, or credentials.

After tester verification and PM acceptance, the engineer makes the single focused commit, the orchestrator locally merges/pushes without a pull request, and on-call observes the normal automatic deployment. No commit, push, workflow dispatch, schedule manipulation, or deployment belongs to grooming.

[alexeygrigorev]

Grooming Complete

Verdict: READY FOR ENGINEERING — conservative selective CI with scheduled full coverage

Groomed against exact website main 872fd8a9145a0e29de8890e9ea3e9d8df8c63cfd, the current CI/deployment graph, uv-backed Make targets, documented application boundaries, and official GitHub push/schedule/history/permission/concurrency semantics.

The issue now fixes the normal-push range at github.event.before → validated github.event.after/github.sha, requires a full-history NUL-safe rename/copy-aware diff, and permits focused Django tests only for one fully mapped application root. The exact path-to-label closures are checked into the contract; multiple apps plus shared/auth/core/testless, migrations, templates/static, dependencies, configuration, workflow/deploy, docs/generated, unknown, or malformed changes fail safe to the full suite. Non-probe manual releases are always full; existing probes remain separate.

Existing full quality, core Playwright, SQLite setup, container verification, immutable source/image checks, serialized automatic deployment, and job-level AWS permissions remain required. A new always-evaluated aggregate gate prevents conditional/skipped jobs from weakening publish or deployment.

The separate 17 */4 * * * UTC workflow has only contents: read and actions: read, no AWS/deploy authority, and its own non-cancelling queued concurrency. It treats only a successful fixed full-regression marker as coverage, retries unchanged SHAs after any failed/cancelled/timeout run, skips only an exact successfully covered SHA, and falls back to a full run on absent or ambiguous history. Selection, anchor, retry, aggregation, permission, and observability scenarios are explicit.

No implementation, application behavior, database, test expectation, template, AWS resource, workflow run, deployment, commit, or push was changed by grooming. needs grooming was removed and enhancement was added; existing P1, operations, and testing labels remain.

[alexeygrigorev]

Software Engineer Report

Implemented the groomed selective-CI and scheduled-full-regression contract against baseline 872fd8a9145a0e29de8890e9ea3e9d8df8c63cfd. The candidate remains uncommitted.

Implementation

• Added a deterministic, schema-versioned normal-CI classifier with the exact reviewed application closures, force-full precedence, NUL-safe rename/copy parsing, ordinary-file enforcement, closed label allowlist, exact push range validation, and fail-safe full fallbacks.
• Added a one-process focused Django runner and uv-backed make test-ci / make test-ci-focused targets.
• Preserved manual release compatibility by running the committed controller classifier against the exact selected release tree; non-probe manual dispatch always selects full and probe behavior remains separate.
• Added the always-evaluated normal aggregate gate and made automatic prior capture, publish, and deploy consume it while retaining their existing data/image prerequisites and release ordering.
• Added a separate 17 */4 * * * scheduled workflow with queued non-cancelling concurrency, exact scheduled SHA checks, read-only contents/actions permissions, no AWS or deployment authority, bounded workflow-history selection, fixed full-regression coverage marker, and an always-running aggregate gate.
• Added safe deterministic JSON/summary artifacts, workflow-contract tests, scheduler/gate tests, and operator documentation.
• No application behavior, model, migration, fixture, HTML/template, public page, Django admin, Studio, admin API, token-generation, probe, or AWS-resource change was made.

Verification

• uv sync --locked; uv lock --check: passed.
• make lint; make format-check; make typecheck: passed (254 source files typed).
• make terminology-check; make database-portability-check; make migrations-check; make django-check; make deployment-check: passed. No migrations detected; OpenAPI/parity/system/deployment checks are current.
• make test-ci: 99 passed.
• Representative focused execution through make test-ci-focused: one Django process, 32 tests, passed.
• Fixed fallback/schedule evidence under .tmp/issue-104/evidence/: focused, fallback-full, first-run, changed-SHA, unchanged-skip, failed-retry, and API-unavailable cases; output is deterministic and contains no secrets/raw responses.
• make test: compatibility 289 passed; complete Django suite 1410 passed with fresh SQLite.
• make test-playwright-core: 42 passed, 3 skipped (only the existing deployed-only cases).
• Production image: linux/amd64 build passed; exact revision label and runtime 10001:10001/uid/gid checks passed; valid static manifest passed; absent, malformed, missing-entry, and incompatible-backend cases all failed closed as required; exact /health/live version response and /unified/ returned HTTP 200. Local port 8000 was occupied by an unrelated process, so the successful parity check mapped isolated host port 18004 to container port 8000.
• actionlint and git diff --check: passed. The checked-in actionlint configuration narrowly suppresses only its stale diagnostic for GitHub's documented concurrency.queue: max syntax.
• Candidate status contains only CI workflow/configuration, CI modules/tests, Make targets, and CI documentation. No HTML/template path is changed.

Handoff

• Worktree: /home/alexey/git/dtc-website/.tmp/website-104-selective-ci
• Branch: issue-104-selective-ci
• No commit, push, workflow dispatch, schedule manipulation, publication, or deployment was performed.
• Browser screenshots are not applicable because this issue has no user-facing/template change.

[alexeygrigorev]

QA Review

Verdict: FAIL — malformed scheduled job history can incorrectly skip the full regression

I independently reviewed the complete uncommitted candidate in /home/alexey/git/dtc-website/.tmp/website-104-selective-ci against the groomed issue and baseline 872fd8a9145a0e29de8890e9ea3e9d8df8c63cfd. I did not edit, commit, push, dispatch a workflow, manipulate a schedule, or deploy anything.

Blocking finding

The scheduled coverage marker does not fail closed on a malformed marker-job object. In ci/schedule.py:371-391, _full_regression_marker accepts a missing run_id (job_run_id is not None is optional) and never validates the marker's status. Consequently both of these malformed latest-job payloads are accepted as successful coverage anchors:

{"name": "full-regression", "conclusion": "success"}
{"name": "full-regression", "run_id": 8, "status": "in_progress", "conclusion": "success"}

With a successful same-SHA workflow-run record, direct independent calls to decide_schedule(...) returned:

decision=skip
reason=already_successfully_covered
coverage_anchor_run_id=8

Expected: malformed or internally inconsistent job history raises HistoryUnavailable; the workflow then emits decision=run_full, reason=history_unavailable. Actual: the selector treats the malformed record as proof of full coverage and skips all scheduled components.

This violates the acceptance criteria requiring malformed/ambiguous history to run full, only a matching latest-attempt full-regression job that actually concluded successfully to serve as an anchor, and API ambiguity never to become a skip. The existing suite checks malformed workflow-run objects and duplicate/missing markers, but does not cover missing marker run_id or an inconsistent marker status/conclusion pair.

Independent checks completed

• uv sync --locked; uv lock --check: passed.
• make test-ci: 99 passed.
• make lint: passed.
• make format-check: 327 files already formatted.
• make typecheck: 254 source files, no issues.
• actionlint 1.7.12 -config-file .github/actionlint.yaml: passed. I independently downloaded the exact release binary below project-local .tmp/issue-104/qa/; the narrow queue: max suppression produced no other ignored diagnostics.
• Both workflow YAML files parsed with the locked Python environment: passed.
• git diff --check: passed.
• Representative code-owned content selection produced exactly accounts content.tests core; CI_SELECTION_PATH=.tmp/issue-104/qa/focused-content.json make test-ci-focused: one Django process, 594 tests passed, fresh SQLite test database created/destroyed.
• make terminology-check; make database-portability-check; make migrations-check; make django-check; make deployment-check: passed. No migration drift; management OpenAPI/parity current; no ordinary-CI PostgreSQL service was added. The production deployment check retains its non-connecting placeholder URL only.
• make test-playwright-core: 42 passed, 3 existing deployed-only skips.
• Candidate path audit: only CI workflow/configuration, CI modules/tests/docs, and Make targets; no changed HTML/template path and no Django application/model/migration change.
• Scheduled workflow static audit: exact 17 */4 * * *, separate non-cancelling queue: max concurrency, only contents: read/actions: read, exact SHA checkout, fixed marker/gate, and no AWS/OIDC/environment/publish/deploy job.
• Normal workflow static audit: exact push before/after inputs, closed classifier outputs, always aggregate gate, and capture/publish/deploy require ci-gate while probe jobs remain separate.

The independent full make test and container parity rerun are deferred until the blocking scheduler correction, because this candidate cannot pass QA regardless of those results. Browser screenshots are not applicable: the candidate has no public-page or template change.

Required correction and recheck

Require a marker used as coverage to be a well-formed completed latest-attempt job belonging exactly to the requested run (at minimum exact positive integer run_id == run_id, status == completed, and conclusion in the permitted marker states), treat missing/inconsistent fields as HistoryUnavailable, and add regression fixtures for missing/wrong/bool run_id plus missing/non-completed/mismatched status/conclusion. Then return the candidate for focused scheduler tests and the remaining broad parity gates.

[alexeygrigorev]

Software Engineer Correction Report

Corrected the blocking scheduler-history finding from the independent QA review. The candidate remains uncommitted.

Correction

• A full-regression marker now must contain an exact positive non-boolean integer run_id equal to the workflow run being inspected.
• The marker must have status=completed before its conclusion can be considered.
• A completed marker may be success (coverage anchor) or skipped (intentional selector-only run, never an anchor). Missing/unknown conclusions or any other conclusion on a successful workflow are ambiguous and raise HistoryUnavailable.
• The existing filter=latest jobs request remains mandatory and covered by its API contract test.
• Documentation now records the exact run-id/completed/successful anchor requirements.

Regression evidence

• Direct reproduction, missing marker run_id: run_full / history_unavailable.
• Direct reproduction, status=in_progress with conclusion=success: run_full / history_unavailable.
• Added focused cases for missing, wrong, boolean, string, and non-positive run IDs; missing/queued status; missing/unknown conclusion; a failed marker on a successful workflow; and the two exact QA payloads. Existing completed-success and completed-skipped behavior remains covered.
• pytest ci/tests/test_schedule.py -q: 43 passed.
• make test-ci: 111 passed.
• make lint: passed.
• make format-check: 327 files already formatted.
• make typecheck: 254 source files, no issues.
• make terminology-check: passed.
• actionlint: passed.
• git diff --check: passed.

The correction changes only ci/schedule.py, its focused tests, and CI documentation. No HTML/template, Django application, model, migration, workflow authority, deployment behavior, or credential handling changed. No commit, push, workflow dispatch, schedule manipulation, or deployment was performed.

[alexeygrigorev]

QA Correction Review

Verdict: PASS — the scheduled-history fail-safe hole is corrected

I independently re-reviewed the uncommitted correction in /home/alexey/git/dtc-website/.tmp/website-104-selective-ci. I did not edit, commit, push, dispatch a workflow, manipulate a schedule, or deploy anything.

Blocking reproduction resolved

Both exact payloads from the prior QA failure now raise HistoryUnavailable and map to run_full / history_unavailable:

{"name": "full-regression", "status": "completed", "conclusion": "success"}
{"name": "full-regression", "run_id": 8, "status": "in_progress", "conclusion": "success"}

I independently table-drove the adjacent malformed marker matrix. Wrong integer, boolean, string, zero, and negative run IDs; missing or queued status; and missing, unknown, or failed conclusions all failed closed to run_full / history_unavailable. The boolean case was also checked against history run id 1, proving True cannot pass Python integer equality accidentally.

The valid boundary remains correct:

• exact positive integer run_id, status=completed, conclusion=success, matching current SHA → skip / already_successfully_covered;
• exact completed conclusion=skipped → run_full / no_coverage_anchor, never coverage.

The implementation at ci/schedule.py:371-399 now requires a positive non-boolean integer equal to the inspected run, completed status, and a recognized conclusion before considering the marker. A non-success/non-skipped marker on a successful workflow is ambiguous and fails closed. The API request still uses filter=latest and paginates with the reviewed GitHub version header.

Independent verification

• uv sync --locked; uv lock --check: passed.
• uv run pytest ci/tests/test_schedule.py -q: 43 passed.
• make test-ci: 111 passed.
• Direct independent malformed/valid marker matrix described above: passed.
• make lint: passed.
• make format-check: 327 files already formatted.
• make typecheck: 254 source files, no issues.
• make database-portability-check: passed.
• make migrations-check: no changes detected.
• actionlint 1.7.12 -config-file .github/actionlint.yaml: passed.
• Both workflow YAML documents parsed through the locked Python environment: passed.
• git diff --check: passed.
• Independent full parity make test: compatibility 289 passed; complete Django 1410 passed against isolated SQLite.
• The earlier independent core-browser run on this candidate remains applicable: 42 passed, 3 deployed-only skips. The correction changes only scheduler code/tests/docs, not browser/application code.

Scope and acceptance

The complete candidate path inventory remains limited to .github CI configuration, Makefile, _docs/ci/, and ci/. There are no Django application, model, migration, HTML/template, or static changes. Scheduled permissions/authority, cron/concurrency, normal aggregate/deployment dependencies, and probe separation are unchanged from the earlier static PASS evidence. No PostgreSQL service or ordinary-CI connection was introduced.

Screenshots are not applicable because there is no public-page or template change. The prior QA blocker is closed and issue #104 is technically ready for PM acceptance.

[alexeygrigorev]

Product Acceptance

Verdict: ACCEPT

The final uncommitted candidate delivers the groomed owner value: normal main pushes use deterministic, exact-range selection only for one safely owned application and otherwise fall back to the complete suite; a separate four-hour regression provides full unchanged-SHA coverage without deployment authority. The always-evaluated gates preserve quality, SQLite Django, core Playwright, container, immutable-release/image, publication, and serialized deployment safety.

The prior QA blocker is resolved. Scheduled coverage now requires a matching positive non-boolean run ID, completed marker status, and recognized conclusion; malformed or inconsistent job history fails safe to run_full / history_unavailable. Independent correction QA passed the malformed-marker matrix, 111 CI contract tests, full Django parity (289 compatibility + 1410 Django), and the applicable 42 core browser tests with 3 existing deployed-only skips. Final PM inspection also reran make test-ci (111 passed) and git diff --check successfully.

Scope is correct: the candidate is limited to .github workflow/configuration, Makefile, _docs/ci/, and ci/. There are no Django application, model, migration, HTML/template, or static changes, so screenshots are not applicable. Navigation, copy, authentication/denial, and page-state review are likewise outside this CI-only change.

No [HUMAN] acceptance remains. The focused commit should include Closes #104; the issue does not need to remain open after the accepted commit is merged.

[alexeygrigorev]

On-call release verification — GREEN

Exact pushed main merge SHA: 114be271a36966eb5dbeabd1e811ea910632fa57
Exact tree: 1783e11f3181140a7ff7fc891ac00bf18b8a1bcd

• GitHub main, fetched origin/main, and workflow head resolve to the exact SHA.
• Authoritative push run: https://github.com/DataTalksClub/website/actions/runs/31312602583 — terminal success.
• Required resolve, classification, quality, SQLite/Django, Playwright, immutable-container, aggregate ci-gate, prior capture, publish, and deploy jobs all succeeded. Push-inapplicable probe jobs were skipped by design.
• Classifier artifact selected profile: full, reason configuration_or_dependency, from base ecb79ba5744bc9e8e8ebcef4848b9aaf1d1c2fdf to the exact head across all 17 changed paths, with no focused app labels.
• Django job https://github.com/DataTalksClub/website/actions/runs/31312602583/job/93242688576 received SELECTED_PROFILE: full, executed make test, and passed 289 compatibility tests plus all 1,430 Django tests on SQLite.
• Aggregate evidence records a valid full selection, success for resolve/classification/quality/Django/Playwright/container, and verdict success; release jobs were gated behind it.
• Serialization remained intact. The workflow retains concurrency group website-development-release with cancel-in-progress: false. Run timestamps show non-overlapping release mutation stages: aggregate gate completed at 12:13:29Z; prior capture ran 12:13:33–12:13:49Z; publish ran 12:13:53–12:14:39Z; the single deploy job ran 12:14:44–12:25:08Z.
• Deploy job https://github.com/DataTalksClub/website/actions/runs/31312602583/job/93243113496 succeeded, including atomic web/worker promotion, smoke checks, redacted evidence, recovery checkpoint, and exact successful-release artifact finalization.
• Live GET https://web.dtcdev.click/health/live returns HTTP 200 with exact receipt {"status":"ok","version":"114be271a36966eb5dbeabd1e811ea910632fa57"}.

Scheduled regression registration

• GitHub registers .github/workflows/scheduled-full-regression.yml as active (Scheduled full regression): https://github.com/DataTalksClub/website/blob/main/.github/workflows/scheduled-full-regression.yml
• Exact main defines cron: "17 */4 * * *", an every-four-hours schedule, plus its separate non-cancelling scheduled concurrency group and full aggregate gate.
• The scheduled workflow was not manually dispatched during on-call.

Issue #104 was already auto-closed as completed by the approved Closes #104 commit. On-call made no issue-state change, repository edit, commit, push, workflow dispatch, or manual deployment.