ci: fractional platform validation and exact-SHA release preflight

[zackees]

Scope

Implements fractional CI for FastLED/cli. Ordinary PR/main runs retain Linux x86 lint; ci-test adds host tests; ci-full selects all 29 declared platform workflows, including native Windows ARM tests. The full-coverage report requires successful platform test steps on one exact commit SHA.

Both release entry points are manual and fail closed before creating a tag:

• auto-release.yml verifies a dispatch full-coverage report, builds six wheel/binary pairs, and checks artifacts. dry_run=true performs the preflight without tagging or publishing.
• vscode-extension-release.yml verifies the same exact-SHA full-coverage report, builds seven VSIX packages, and checks exact version, target coverage, ZIP integrity, and extension metadata before creating vscode-v<version>. It also supports dry_run=true. Pushing a VS Code tag no longer starts publication.

The candidate SHA must be the dispatch branch head. A conflicting existing tag fails. The normalized issue-driven release front door and a live nonpublishing release dry run remain pending; registry availability cannot be guaranteed by artifact lint.

Proof and rollout state

The stacked Intel macOS PR #273 passed all 29 platform workflows and the full-coverage sentinel at its earlier head 36221cf (run 35914920276). It also produced a same-SHA unlabeled event for runner-minute measurement. Since this PR has now advanced to 0b38e4e to close the VS Code tag gap, #273 must include the new base commit and rerun full coverage at its new head before merge.

The VS Code release safety change was tested RED→GREEN: both new tests failed before implementation; afterward all 17 focused CI-mode tests passed. Ruff, YAML structure parsing, and git diff --check passed. This PR remains draft under zackees/soldr#3345.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 21769312-cecb-4bdd-9dfd-1a516e4d53c9

📥 Commits

Reviewing files that changed from the base of the PR and between c5dc5f0 and 0b38e4e.

📒 Files selected for processing (49)

• .github/workflows/_build.yml
• .github/workflows/_integration-test.yml
• .github/workflows/_lint.yml
• .github/workflows/_terminal-test.yml
• .github/workflows/_unit-test.yml
• .github/workflows/auto-release.yml
• .github/workflows/full-coverage.yml
• .github/workflows/linux-arm-build.yml
• .github/workflows/linux-arm-integration-test.yml
• .github/workflows/linux-arm-lint.yml
• .github/workflows/linux-arm-unit-test.yml
• .github/workflows/linux-x86-build.yml
• .github/workflows/linux-x86-dwarf-smoke.yml
• .github/workflows/linux-x86-integration-test.yml
• .github/workflows/linux-x86-lint.yml
• .github/workflows/linux-x86-render-smoke.yml
• .github/workflows/linux-x86-terminal-test.yml
• .github/workflows/linux-x86-unit-test.yml
• .github/workflows/macos-arm-build.yml
• .github/workflows/macos-arm-integration-test.yml
• .github/workflows/macos-arm-lint.yml
• .github/workflows/macos-arm-live-test.yml
• .github/workflows/macos-arm-unit-test.yml
• .github/workflows/macos-x64-guest-webkit-probe.yml
• .github/workflows/macos-x86-build.yml
• .github/workflows/macos-x86-integration-test.yml
• .github/workflows/macos-x86-lint.yml
• .github/workflows/macos-x86-unit-test.yml
• .github/workflows/vscode-extension-release.yml
• .github/workflows/vscode-extension.yml
• .github/workflows/windows-arm-build.yml
• .github/workflows/windows-arm-integration-test.yml
• .github/workflows/windows-arm-unit-test.yml
• .github/workflows/windows-x86-build.yml
• .github/workflows/windows-x86-integration-test.yml
• .github/workflows/windows-x86-lint.yml
• .github/workflows/windows-x86-terminal-test.yml
• .github/workflows/windows-x86-unit-test.yml
• CLAUDE.md
• ci/capture_soldr_failure.ps1
• ci/check_full_coverage.py
• ci/full_coverage.json
• ci/release_artifact_lint.py
• ci/verify_full_coverage.py
• ci/vscode_release_artifact_lint.py
• docs/FRACTIONAL_CI.md
• setup.py
• tests/unit/test_ci_modes.py
• tests/unit/test_setup_packaging.py

 ___________________________________________________________________
< That's not a helper function. That's a co-dependent relationship. >
 -------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[zackees]

Release-safety review note: this is a useful pretag gate, but it is an interim step rather than the fleet-normalized issue-driven release mechanism in soldr #3343/#3345. Both manual publishers currently require candidate_sha == GITHUB_SHA at workflow_dispatch (full-coverage jobs). That binds the candidate to the selected branch head at dispatch time; after main advances, retrying the same already-validated version/SHA with --ref main will fail before artifact/publish reconciliation. The jobs also create the tag before independently publishing PyPI/GitHub or Marketplace, without an issue control record for partial destination state. Please keep PR/agent docs explicit that neither same-identity resume nor atomic-ish issue-driven publication is proven here. No request to weaken the pretag full gate or dry-run behavior; these are follow-up blockers for the normalized release contract, not reasons to auto-tag.