ci: split validation into responsibility groups

.github/workflows/ci.yml

@@ -14,74 +14,172 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  windows-script-validation:
-    runs-on: windows-latest
-    timeout-minutes: 30
+  repository-checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Run repository checks
+        run: python3 scripts/run_local_ci.py --profile portable --group repository --require-clean --summary-dir target/local-ci/portable-repository
+      - name: Upload local CI summary
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: local-ci-summary-portable-repository
+          path: target/local-ci/portable-repository
+          if-no-files-found: warn
 
+  script-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v5
+      - name: Run portable script tests
+        run: python3 scripts/run_local_ci.py --profile portable --group scripts --require-clean --summary-dir target/local-ci/portable-scripts
+      - name: Upload local CI summary
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: local-ci-summary-portable-scripts
+          path: target/local-ci/portable-scripts
+          if-no-files-found: warn
 
+  windows-script-tests:
+    runs-on: windows-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: '3.x'
+      - name: Run Windows repository checks
+        shell: pwsh
+        run: python scripts/run_local_ci.py --profile windows --group repository --require-clean --summary-dir target/local-ci/windows-repository
+      - name: Run Windows script tests
+        shell: pwsh
+        run: python scripts/run_local_ci.py --profile windows --group scripts --require-clean --summary-dir target/local-ci/windows-scripts
+      - name: Upload repository summary
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: local-ci-summary-windows-repository
+          path: target/local-ci/windows-repository
+          if-no-files-found: warn
+      - name: Upload script summary
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: local-ci-summary-windows-scripts
+          path: target/local-ci/windows-scripts
+          if-no-files-found: warn
 
+  java-linux:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
       - name: Set up Java 21
         uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '21'
           cache: maven
-
-      - name: Run Windows CI preflight
-        shell: pwsh
-        run: python scripts/run_local_ci.py --profile windows --require-clean --summary-dir target/local-ci/windows
-
+      - name: Run Linux Java verification
+        run: python3 scripts/run_local_ci.py --profile portable --group java --require-clean --summary-dir target/local-ci/portable-java
       - name: Upload local CI summary
         if: always()
         uses: actions/upload-artifact@v6
         with:
-          name: local-ci-summary-windows
-          path: target/local-ci/windows
+          name: local-ci-summary-portable-java
+          path: target/local-ci/portable-java
           if-no-files-found: warn
-
       - name: Upload JaCoCo coverage report
         uses: actions/upload-artifact@v6
         with:
-          name: jacoco-coverage-report-windows
+          name: jacoco-coverage-report-linux
           path: target/site/jacoco
           if-no-files-found: error
 
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
+  java-windows:
+    runs-on: windows-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v5
-
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.x'
       - name: Set up Java 21
         uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '21'
           cache: maven
-
-      - name: Run portable CI preflight
-        run: python3 scripts/run_local_ci.py --profile portable --require-clean --summary-dir target/local-ci/portable
-
+      - name: Run Windows Java verification
+        shell: pwsh
+        run: python scripts/run_local_ci.py --profile windows --group java --require-clean --summary-dir target/local-ci/windows-java
       - name: Upload local CI summary
         if: always()
         uses: actions/upload-artifact@v6
         with:
-          name: local-ci-summary-linux
-          path: target/local-ci/portable
+          name: local-ci-summary-windows-java
+          path: target/local-ci/windows-java
           if-no-files-found: warn
-
       - name: Upload JaCoCo coverage report
         uses: actions/upload-artifact@v6
         with:
-          name: jacoco-coverage-report-linux
+          name: jacoco-coverage-report-windows
           path: target/site/jacoco
           if-no-files-found: error
+
+  ci-required:
+    if: ${{ always() }}
+    needs: [repository-checks, script-tests, windows-script-tests, java-linux, java-windows]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require all execution jobs
+        env:
+          REPOSITORY: ${{ needs.repository-checks.result }}
+          SCRIPTS: ${{ needs.script-tests.result }}
+          WINDOWS_SCRIPTS: ${{ needs.windows-script-tests.result }}
+          JAVA_LINUX: ${{ needs.java-linux.result }}
+          JAVA_WINDOWS: ${{ needs.java-windows.result }}
+        run: |
+          printf '%s\n' "repository-checks=$REPOSITORY" "script-tests=$SCRIPTS" "windows-script-tests=$WINDOWS_SCRIPTS" "java-linux=$JAVA_LINUX" "java-windows=$JAVA_WINDOWS"
+          [[ "$REPOSITORY" == success && "$SCRIPTS" == success && "$WINDOWS_SCRIPTS" == success && "$JAVA_LINUX" == success && "$JAVA_WINDOWS" == success ]]
+
+  build:
+    if: ${{ always() }}
+    needs: [repository-checks, script-tests, java-linux]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require Linux execution jobs
+        env:
+          REPOSITORY: ${{ needs.repository-checks.result }}
+          SCRIPTS: ${{ needs.script-tests.result }}
+          JAVA_LINUX: ${{ needs.java-linux.result }}
+        run: |
+          printf '%s\n' "repository-checks=$REPOSITORY" "script-tests=$SCRIPTS" "java-linux=$JAVA_LINUX"
+          [[ "$REPOSITORY" == success && "$SCRIPTS" == success && "$JAVA_LINUX" == success ]]
+
+  windows-script-validation:
+    if: ${{ always() }}
+    needs: [windows-script-tests, java-windows]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require Windows execution jobs
+        env:
+          WINDOWS_SCRIPTS: ${{ needs.windows-script-tests.result }}
+          JAVA_WINDOWS: ${{ needs.java-windows.result }}
+        run: |
+          printf '%s\n' "windows-script-tests=$WINDOWS_SCRIPTS" "java-windows=$JAVA_WINDOWS"
+          [[ "$WINDOWS_SCRIPTS" == success && "$JAVA_WINDOWS" == success ]]

CHANGELOG.md

@@ -4,6 +4,7 @@ All notable maintenance updates to this fork are documented here.
 
 ## Unreleased
 
+- Split CI into independent repository, script, and Java jobs with grouped local entrypoints and a unified `ci-required` gate; retain the existing required-check names during migration.
 - Save KataGo rule preferences on confirmation and close the settings dialog after successful application.
 - Keep SGF rule-failure navigation local until explicit confirmed restore, preserve trial-return rules and positions, and resume both comparison engines after synchronization (#448).
 - Keep thread-source controls visible and locked to CFG for empty or unrecognized local targets, without explanatory warnings (#437).

docs/DEVELOPMENT.md

@@ -68,6 +68,49 @@ powershell -ExecutionPolicy Bypass -File scripts/run_local_ci.ps1 -Profile All -
 可只查看计划执行的步骤。`LIZZIE_PYTHON`、`LIZZIE_MAVEN`、`LIZZIE_BASH`
 和 `LIZZIE_POWERSHELL` 可用于指定工具路径。
 
+按职责选择 `--group all|repository|scripts|java`（PowerShell 为 `-Group`），默认
+`all` 保持原完整调用。所有组都需要 Python 和 Git，并执行 `git diff --check`；
+`--require-clean` / `-RequireClean` 保留运行前后的干净工作树检查。
+
+| Group | Portable | Windows | 额外工具 |
+| --- | --- | --- | --- |
+| `repository` | 换行自测、换行、Markdown 链接 | 换行 | 无 |
+| `scripts` | Python 辅助脚本、KataGo shell、Bash 语法 | JCEF、NVIDIA、RTX50 PowerShell 语法 | Portable 需 Bash；Windows 需 PowerShell |
+| `java` | 原完整 Maven verify | 凭据专项，再执行原完整 Maven verify | Maven、JDK 21；不查找 Bash/PowerShell |
+
+例如仅运行无 Java 的仓库检查：
+
+```bash
+bash scripts/run_local_ci.sh --profile portable --group repository --summary-dir target/local-ci/portable-repository
+```
+
+```powershell
+pwsh -File scripts/run_local_ci.ps1 -Profile Windows -Group Scripts -SummaryDir target/local-ci/windows-scripts
+```
+
+`profile=all` 合并并去重两套检查，只执行一次 Windows 全量 verify 和凭据专项，
+不表示跨 OS 验收。不要在同一 checkout 并行运行两个写入 `target` 的 Maven 调用；
+需要并行时使用独立 worktree。
+
+多次分组调用请使用不同 summary 目录；默认仍为 `target/local-ci/`。
+JSON/Markdown 摘要增加 `group`；非 Java 组不清理或读取既有 JUnit 报告，
+Java/JUnit 状态为未执行。真实 Java 调用先清除旧 Surefire/Failsafe 报告，再收集本次结果。
+Dry-run 仅生成计划，不代表检查通过。
+
+Actions 的 `ci.yml` 对所有 PR（包括仅文档改动）和 main push 执行五个独立 job：
+`repository-checks`、`script-tests`、`windows-script-tests`、`java-linux`、`java-windows`。
+Windows 脚本 job 依次运行 `windows/repository` 与 `windows/scripts`，摘要独立上传。
+两平台 Java job 保留全量测试、`LoggingProviderSmokeIT`、shaded JAR 和 JaCoCo；
+验证成功但 coverage artifact 缺失仍失败。各组失败时仍尝试上传本组摘要。
+
+`ci-required` 直接要求五项全部成功。迁移期间 `build` 汇总两个 Portable 非 Java job
+和 `java-linux`；`windows-script-validation` 汇总两个 Windows job。三个汇总器均拒绝
+失败、取消、跳过、缺失或未知结果。发布仍仅接受目标 SHA 的 `ci.yml` push 成功运行。
+
+首个 PR 合并且对应 main push CI 成功后，请 wimi321 将 main required checks 替换为
+GitHub Actions 来源的 `ci-required`，其他保护设置不变。确认设置生效后，后续 PR
+才删除两个旧汇总门禁；当前 PR 不需要管理员预先修改保护。
+
 本地预检用于在推送前尽早发现问题，不能代替受保护分支上的干净 Windows 和
 Ubuntu runner，也不能代替 macOS 签名、公证与多平台发布资产审计。