SRE-1060: Let turbo's task graph drive pruning and CI selection

.config/mise/config.toml

@@ -17,7 +17,7 @@ minimum_release_age                 = "7d"
 [tools]
 # Basic tools
 node        = { version = "22.21.1", postinstall = "corepack enable" }
-"npm:turbo" = "2.10.12"
+"npm:turbo" = "2.11.2"
 
 # Helper to install tools
 cargo-binstall = "1.19.1"

.github/scripts/affected-packages.sh

@@ -6,8 +6,9 @@
 # `tasks` seeds the `affectedTasks` query rather than filtering it, so the
 # result also carries the tasks needed to run the requested ones; only items
 # with a requested name count. A task wired via `dependsOn` materializes a
-# node in every package, so a package makes the matrix only for tasks it has
-# a script for. Each task key holds the reason the package was selected.
+# node in every package, so a package makes the matrix only for tasks turbo
+# resolves a command for, whether from a `package.json` script or a `command`
+# in a `turbo.json`. Each task key holds the reason the package was selected.
 set -euo pipefail
 
 if [[ $# -eq 0 ]]; then
@@ -27,7 +28,7 @@ done
 
 TASKS=$(printf '%s\n' "$@" | jq --raw-input --slurp --compact-output 'split("\n") | map(select(length > 0))')
 
-QUERY="query { affectedTasks(base: \"HEAD^\", tasks: $TASKS) { items { name script package { name path } reason { __typename ... on TaskFileChanged { filePath } ... on TaskDependencyTaskChanged { taskName packageName } ... on TaskPackageDependencyChanged { packageName } ... on TaskGlobalFileChanged { filePath } ... on TaskGlobalDepsChanged { filePath } ... on TaskAllChanged { description } } } } }"
+QUERY="query { affectedTasks(base: \"HEAD^\", tasks: $TASKS) { items { name command package { name path } reason { __typename ... on TaskFileChanged { filePath } ... on TaskDependencyTaskChanged { taskName packageName } ... on TaskPackageDependencyChanged { packageName } ... on TaskGlobalFileChanged { filePath } ... on TaskGlobalDepsChanged { filePath } ... on TaskAllChanged { description } } } } }"
 
 # `$tasks` is a jq variable, not shell.
 # shellcheck disable=SC2016
@@ -39,7 +40,7 @@ turbo query "$QUERY" | jq --compact-output --argjson tasks "$TASKS" '
       else "\(.__typename): \(.description // "")"
       end;
   [.data.affectedTasks.items[]
-    | select((.name | IN($tasks[])) and .script != null and .package.name != "//")
+    | select((.name | IN($tasks[])) and .command != null and .package.name != "//")
     | { task: .name, name: .package.name, path: .package.path, why: why }]
   | group_by(.name)
   | map({ name: .[0].name, path: .[0].path } + (map({ (.task): .why }) | add))

apps/brunch-agent/docker/Dockerfile

@@ -34,7 +34,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
 RUN mise trust && \
-    turbo prune $(.github/scripts/prune-scopes.sh '@apps/brunch-agent') --docker && \
+    turbo prune '@apps/brunch-agent' --docker && \
     find $(yq '.workspace.members' -o tsv Cargo.toml | tr '*' ' ') -maxdepth 2 -name Cargo.toml -exec sh -c ' \
     [ -f "/repo/out/full/$1" ] || ( \
     mkdir -p "/repo/out/full/$(dirname "$1")/src" && \

apps/hash-ai-worker-ts/docker/Dockerfile

@@ -31,7 +31,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
 RUN mise trust && \
-    turbo prune $(.github/scripts/prune-scopes.sh '@apps/hash-ai-worker-ts') --docker && \
+    turbo prune '@apps/hash-ai-worker-ts' --docker && \
     find $(yq '.workspace.members' -o tsv Cargo.toml | tr '*' ' ') -maxdepth 2 -name Cargo.toml -exec sh -c ' \
     [ -f "/app/out/full/$1" ] || ( \
     mkdir -p "/app/out/full/$(dirname "$1")/src" && \

apps/hash-api/docker/Dockerfile

@@ -31,7 +31,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
 RUN mise trust && \
-    turbo prune $(.github/scripts/prune-scopes.sh '@apps/hash-api') --docker && \
+    turbo prune '@apps/hash-api' --docker && \
     find $(yq '.workspace.members' -o tsv Cargo.toml | tr '*' ' ') -maxdepth 2 -name Cargo.toml -exec sh -c ' \
     [ -f "/app/out/full/$1" ] || ( \
     mkdir -p "/app/out/full/$(dirname "$1")/src" && \

apps/hash-frontend/docker/Dockerfile

@@ -28,7 +28,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
 RUN mise trust && \
-    turbo prune $(.github/scripts/prune-scopes.sh '@apps/hash-frontend') --docker && \
+    turbo prune '@apps/hash-frontend' --docker && \
     find $(yq '.workspace.members' -o tsv Cargo.toml | tr '*' ' ') -maxdepth 2 -name Cargo.toml -exec sh -c ' \
     [ -f "/app/out/full/$1" ] || ( \
     mkdir -p "/app/out/full/$(dirname "$1")/src" && \

apps/hash-graph/docker/Dockerfile

@@ -32,7 +32,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
 RUN mise trust && \
-    turbo prune $(.github/scripts/prune-scopes.sh '@apps/hash-graph') --docker && \
+    turbo prune '@apps/hash-graph' --docker && \
     find $(yq '.workspace.members' -o tsv Cargo.toml | tr '*' ' ') -maxdepth 2 -name Cargo.toml -exec sh -c ' \
     [ -f "/app/out/full/$1" ] || ( \
     mkdir -p "/app/out/full/$(dirname "$1")/src" &&  \

apps/hash-integration-worker/docker/Dockerfile

@@ -31,7 +31,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
 COPY . .
 
 RUN mise trust && \
-    turbo prune $(.github/scripts/prune-scopes.sh '@apps/hash-integration-worker') --docker && \
+    turbo prune '@apps/hash-integration-worker' --docker && \
     find $(yq '.workspace.members' -o tsv Cargo.toml | tr '*' ' ') -maxdepth 2 -name Cargo.toml -exec sh -c ' \
     [ -f "/app/out/full/$1" ] || ( \
     mkdir -p "/app/out/full/$(dirname "$1")/src" && \

apps/petrinaut-opt/docker/Dockerfile

@@ -23,7 +23,7 @@ RUN apt-get update && \
     /etc/mise/install.sh && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
-    mise install --locked node npm:turbo yq
+    mise install --locked node npm:turbo
 
 
 FROM bindings-tools AS bindings-pruner
@@ -33,7 +33,7 @@ WORKDIR /repo
 COPY . .
 
 RUN mise trust && \
-    turbo prune $(.github/scripts/prune-scopes.sh '@local/petrinaut-python') --docker
+    turbo prune '@local/petrinaut-python' --docker
 
 
 FROM bindings-tools AS bindings-builder

libs/@local/graph/atlas/docker/Dockerfile

@@ -35,7 +35,7 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
 COPY . .
 # `turbo prune` does not include Cargo workspaces, so we create dummy projects for each workspace member
 RUN mise trust && \
-    turbo prune $(.github/scripts/prune-scopes.sh '@rust/hash-graph-atlas') --docker && \
+    turbo prune '@rust/hash-graph-atlas' --docker && \
     find $(yq '.workspace.members' -o tsv Cargo.toml | tr '*' ' ') -maxdepth 2 -name Cargo.toml -exec sh -c ' \
     [ -f "/app/out/full/$1" ] || ( \
     mkdir -p "/app/out/full/$(dirname "$1")/src" &&  \

libs/@local/graph/postgres-store/turbo.json

@@ -1,11 +1,6 @@
 {
   "extends": ["//"],
   "tasks": {
-    "dev": {
-      "cache": false,
-      "persistent": true,
-      "dependsOn": ["@apps/hash-graph#start:test:migrate"]
-    },
     "test:integration": {
       "dependsOn": ["^manifest", "@rust/hash-graph-migrations#start:migrate:up"]
     }

libs/@local/petrinaut-arch-docs/turbo.json

@@ -2,13 +2,11 @@
   "extends": ["//"],
   "tasks": {
     "doc:architecture": {
-      // Not cached. Turborepo hashes a task's own package plus its dependencies'
-      // task *outputs*, and the annotations this reads are plain source comments
-      // in `@hashintel/petrinaut`, `petrinaut-core`, and `petrinaut-cli`, which
-      // are not any task's output.
-      // A cached result would therefore survive an annotation change and go
-      // quietly stale, which is the exact failure this package exists to prevent.
-      // The run takes a few seconds; correctness is worth more here.
+      // The annotations this reads are source comments in the packages it depends
+      // on; `^manifest` carries their sources into the hash.
+      "dependsOn": ["^manifest"],
+      // Not cached: with `PETRINAUT_ARCH_DOCS_DIFF_BASE` the build annotates the
+      // difference to a git ref whose content the hash cannot see.
       "cache": false,
       // Declared so consumers can depend on this task rather than on the
       // directory existing, and so `turbo run` prunes it on a clean.

tests/hash-playwright/turbo.json

@@ -36,9 +36,12 @@
         "@blockprotocol/graph#build"
       ]
     },
+    // The tests drive the running frontend and API. `^start:test:healthcheck` only waits
+    // for them; `^manifest` carries their sources.
     "test:integration": {
       "dependsOn": [
         "codegen",
+        "^manifest",
         "@apps/plugin-browser#build:test",
         "^start:test:healthcheck"
       ],

turbo.json

@@ -165,5 +165,8 @@
     "CARGO_TERM_PROGRESS_WHEN",
     "RUSTC_WRAPPER",
     "CARGO_INCREMENTAL"
-  ]
+  ],
+  "futureFlags": {
+    "affectedUsingTaskInputs": true
+  }
 }