fix(ci): restore durable test execution

[khaliqgant]

Summary

• grant the five callers of the reusable change detector the read-only permissions it requests, so workflows create jobs instead of ending in startup_failure
• classify executable .agentworkforce/agents/** files as Node-affecting while keeping trajectories, feature metadata, docs, and other AgentWorkforce records inert
• bridge Relaycast lifecycle statuses by raw value so the Swift SDK builds with both its package-local 6.0.5 lock and the root resolver's 6.2.0
• remove the orphan @agent-relay/workflow-types workspace manifest/link, which advertised nonexistent publishable dist files after workflow code moved to relayflows

Why

Relay CI had three hidden gaps: the reusable workflows could not start because callers did not grant pull-requests: read; agent-only changes were classified as inert and would skip Node tests; and restoring real jobs exposed a stale Swift status switch against Relaycast 6.2.0.

The restored Package Validation job then exposed a fourth pre-existing defect: packages/workflow-types had only a release-bumped package.json, with no source, build script, or dist output. The package was intentionally deleted when relay severed workflow code; 10.6.x was never published. Nested legacy consumers continue resolving the published 6.3.6 dependency.

Validation

• actionlint -shellcheck= -pyflakes= on the five callers plus detect-changes.yml
• explicit caller-permission contract probe
• exact production-classifier probe in completed GitHub job 88019890429: agent_runtime_probe rust_changed=false node_changed=true sdk_swift_changed=false
• swift build in packages/sdk-swift against Relaycast 6.0.5
• root swift build against Relaycast 6.2.0
• surgical lockfile removal only: local npm ci --ignore-scripts --dry-run exits 0; no release-version normalization
• git diff --check
• no generated root Package.resolved

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes refine GitHub Actions scope detection and permissions, expand Swift Relaycast lifecycle-state bridging, update related tests and changelog text, and remove the workflow-types package manifest.

Changes

CI scope detection and permissions

Layer / File(s)	Summary
Agent runtime scope classification .github/workflows/detect-changes.yml	Agent runtime files are classified separately from inert .agentworkforce/ paths, with centralized Rust, Node, and Swift scope detection plus a Node-only probe.
Detected scope output wiring .github/workflows/detect-changes.yml	Job outputs now use classifier results combined with unknownScope for fail-open behavior.
Workflow token permissions .github/workflows/{node-compat,package-validation,rust-ci,security,test}.yml	Workflows explicitly grant read-only contents and pull-requests permissions.

Swift status compatibility

Layer / File(s)	Summary
Relaycast status bridging packages/sdk-swift/Sources/AgentRelaySDK/Relaycast*.swift, CHANGELOG.md, packages/workflow-types/package.json	Relaycast lifecycle strings map to existing Swift presence states, the compatibility change is recorded, and the workflow-types package manifest is removed.
Lifecycle status validation packages/sdk-swift/Tests/AgentRelaySDKTests/AgentRelaySDKTests.swift	Tests cover known lifecycle values and map unrecognized hosted values to .unknown.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant DetectChanges
  participant Classifier
  participant CIJobs
  GitHubActions->>DetectChanges: provide pull request file list
  DetectChanges->>Classifier: classify agent runtime and scoped files
  Classifier-->>DetectChanges: detected Rust, Node, and Swift scope
  DetectChanges->>CIJobs: publish gated job outputs

Loading

Possibly related PRs

• AgentWorkforce/relay#1188: Touches the same Swift Relaycast-to-AgentRelaySDK status bridging logic and tests.
• AgentWorkforce/relay#1259: Relates to the Relaycast v6.0.5 status-bridging facade.
• AgentWorkforce/relay#1271: Modifies the shared CI change-scope classifier and downstream gating.

Suggested labels: size:L

Suggested reviewers: willwashburn

Poem

A bunny hops through scopes so bright,
Node-only paths now gate just right.
Swift states bloom from relay streams,
Unknowns fade into .unknown dreams.
Read-only tokens guard the way.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately reflects the PR’s CI durability fixes.
Description check	✅ Passed	The description includes the main summary and validation details, with the required test-plan content covered and screenshots reasonably omitted.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ci-durable-agent-tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}