Merge remote-tracking branch 'upstream/main' into feature/self-host-runners

scripts/github/resolve/README.md

@@ -4,6 +4,6 @@ Shell helpers that derive structured inputs and outputs for GitHub Actions jobs
 
 ## Scope 📋
 
-This directory contains pure resolvers that read repository state (git history, role metadata, version tags, input environment variables) and emit resolved values either via `$GITHUB_OUTPUT` or stdout. Resolvers MUST be idempotent and MUST NOT mutate repository or registry state beyond writing to `$GITHUB_OUTPUT`. The covered concerns are distro selection for push CI, diff-driven app whitelist resolution, release-tag parsing, app discovery for the deploy matrix, and change detection that gates the update pipeline.
+This directory contains pure resolvers that read repository state (git history, role metadata, version tags, input environment variables) and emit resolved values either via `$GITHUB_OUTPUT` or stdout. Resolvers MUST be idempotent and MUST NOT mutate repository or registry state beyond writing to `$GITHUB_OUTPUT`. The covered concerns are distro selection for push CI, diff-driven app whitelist resolution, the `🧩 Subset` label dispatch (`pr_affected_roles.sh`, which picks between the PR-body subset and the diff resolver), release-tag parsing, app discovery for the deploy matrix, and change detection that gates the update pipeline.
 
 For the workflow catalog that consumes these outputs see [workflows.md](../../../docs/contributing/tools/github/actions/workflows.md). For the diff-driven whitelist contract see the "Diff-driven app selection" section in [pipeline.md](../../../docs/contributing/artefact/git/pipeline.md).

scripts/github/resolve/pr_affected_roles.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+#
+# Resolve the role whitelist for a pull-request CI run and write
+# `whitelist` + `roles_only` to GITHUB_OUTPUT. This is the single
+# entry point the `detect-affected-roles` job calls; it keeps the
+# subset-vs-diff selection logic out of the workflow YAML.
+#
+# Inputs via env:
+#   SUBSET_LABELED  "true" when the PR carries the '🧩 Subset' label.
+#                   When set, the explicit role list declared in the PR
+#                   body wins, resolved by the cli.meta.ci.subset_roles
+#                   module (strict: it fails the run on
+#                   invalid/empty/unknown roles).
+#                   Otherwise the diff-derived resolver runs unchanged.
+#   PR_BODY         PR body markdown (only read on the subset path).
+#
+# Outputs (GITHUB_OUTPUT):
+#   whitelist=<role-id ...|__ALL__>
+#   roles_only=<true|false>
+
+set -euo pipefail
+
+: "${GITHUB_OUTPUT:?Missing GITHUB_OUTPUT}"
+
+if [[ "${SUBSET_LABELED:-}" == "true" ]]; then
+	echo "🧩 Subset label present: restricting CI to the roles listed in the PR body."
+	exec python -m cli.meta.ci.subset_roles
+fi
+
+resolved="$(./scripts/meta/resolve/diff/affected_roles.sh)"
+echo "Resolver output: ${resolved}"
+if [[ "${resolved}" == "__ALL__" ]]; then
+	printf 'whitelist=__ALL__\nroles_only=false\n' >>"${GITHUB_OUTPUT}"
+else
+	printf 'whitelist=%s\nroles_only=true\n' "${resolved}" >>"${GITHUB_OUTPUT}"
+fi