Reusable GitHub Actions

[lann]

Composite actions / reusable workflows, one per concern:

• run-suite: inputs = suite artifact, runner kind, target name; runs and uploads the canonical results JSON as an artifact. Per-target logs under ::group::.
• aggregate: downloads results artifacts, runs the validator (fails the check on any transport invariant or case failure), publishes the markdown matrix (job summary) and viewer JSON.
• publish-viewer: deploys the static viewer + aggregate to Pages.
• The seam between "componentize/compose" and "execute" must be a designed artifact boundary, not incidental: webcrypto needed exactly this for its WebKit leg (build artifacts on ubuntu, execute on macos). Cross-OS target matrices depend on it.
• Optional-target semantics surfaced correctly: missing results for an optional target is a warning annotation, never a red check; wrong results always red.
• Targets run in parallel after a single shared artifact-build phase, each capped by a timeout.

[lann]

The two n=1-safe concerns landed at HEAD:

actions/aggregate — composite action: per-target results-JSONL + lockfile + manifest in; the matrix into the job summary; the CLI's warning:/error: findings as workflow annotations; the CLI's own exit code passed through unchanged (missing optional target = warning + green, per this issue's semantics bullet — the aggregate already encodes that, the action adds presentation, never verdict). Without an explicit cli: input it cargo install --lockeds the CLI from this repo at the same ref the action was referenced by, so presentation and validation cannot skew (and #51's committed lock makes that install reproducible). Dogfooded in the verify job: https://github.com/lann/component-test/actions/runs/31045922998 — the summary shows the fixture matrix green with the trap as xfail debt, next to #11's JUnit table.

publish-viewer — as a workflow for now (.github/workflows/pages.yml): https://lann.github.io/component-test/ deploys the viewer + the demo fixtures it fetches by repo-relative path; the page's aggregation engine is the gate's Rust compiled to wasm from the same tree. Verified live in headless Chromium: demo → live fixture run in-browser → adopt → OK / 16 results / 2 expected-fail.

Deliberately not built: run-suite, and generalizing publish-viewer into a reusable action — both parked until a second consumer exists (actions/README.md records the rationale: the generic/specific line for SUT-linked drivers, artifact caches, and browser-leg fallbacks is not knowable from one data point). The artifact-boundary bullet is unchanged and remains the design constraint for that follow-up. Suggest keeping this issue open scoped to run-suite.

[lann]

The aggregate action now has two consumers: polymorph-webcrypto#339 (both suites — two invocations with distinct summary titles) and polymorph-websocket (direct on main). Adoption shape in both: after the repo's own just gate, presentation-only, if: always() so red runs still get annotated, and the prebuilt CLI handed over via cli: so aggregation semantics ride the Cargo.lock pin rather than the action ref.

Two findings from adoption:

1. uses: cannot interpolate, so the action ref is a literal rev — a fourth pin site the pins gate cannot see (it is a workflow file, not a lockfile). Both consumers grew a guard step asserting the ref matches the Cargo.lock rev (pattern aggregate@[0-9a-f]{40} so it cannot match its own source line). Worth documenting in actions/README.md as the recommended pattern — or teaching pins an optional --uses <workflow.yml> input.

2. The run-suite second data point is in, and it argues for staying parked. Both consumers run SUT-linked custom drivers (webcrypto embeds its wasmtime host with gated-feature link options; websocket provisions an echo server, test PKI, and env knobs, and wac-composes a provider+tls stack for its composed leg). Neither could use a generic run-suite action for any leg. The generic/specific line appears to land on: execution is inherently SUT-specific, and what generalizes is the results boundary (CLI + this aggregate action). Suggest re-scoping the parked item accordingly.