CI paths: dirsql-checks ci-paths — assert workflow filters and Mergify anchors agree #862

Part of #834. Phase 5 — the durable anti-drift fix. Blocked on #850 through #861 (there is nothing to compare until both sides exist).

What

After this epic, the same path knowledge lives in two places: each workflow's paths: and each .mergify.yml protection's if:. They drift silently, and one direction of drift deadlocks the merge gate — exactly the failure mode #832 cost an admin bypass to escape.

Per AGENTS.md ("CI logic lives in scripts, not workflow YAML"), the fix is a dirsql-checks subcommand.

The invariant to enforce

From #850:

An anchor's if must never apply more broadly than its workflow's paths: trigger.

Formally, for every anchored workflow W with protection P, and every file path f:

P.if matches f  ⟹  W.paths matches f

The forward direction only. The converse (workflow runs unanchored) is a deliberate, safe slack — release-precheck and changelog-check both rely on it — so the check must not flag it.

How to make that mechanically checkable

Do not attempt general regex-vs-glob equivalence. Sample instead:

1. Take the corpus of candidate paths: every file from git ls-files, plus a synthetic entry per distinct glob in every paths: list (so a glob covering files that do not exist yet is still exercised).
2. For each (W, P) pair and each path f, evaluate both sides and assert the implication above.
3. Report every violating (protection, path) pair, not just the first.

Every tracked file in the repo becomes a test case, and the direction that deadlocks the gate is the direction that fails.

Also assert

• Every merge_protections entry other than Nothing failed has an if: containing base = main and an or: block. An ungated anchor is the CI: #check-pending = 0 deadlocks the Mergify gate (it counts its own check) #832 bug.
• Every success_conditions check pattern maps to a job id that exists in exactly one workflow file — catches a job rename that silently unblocks the gate.
• Every workflow with a paths: filter names its own file in that filter (spec row 16). This is the gate that would have caught the four missing self-paths (CI paths: Python Lint — add self-trigger path #843, CI paths: Python Typecheck — add self-trigger path #844, CI paths: TS Lint — add self-trigger path #845, CI paths: TS Typecheck — add self-trigger path and tsconfig.build.json #846).
• Both paths: lists of a workflow that has push: and pull_request: are identical, unless a reason comment sits directly above.

Implementation

• internals/checks/src/checks/ci_paths/ — new subcommand, registered on the click group in cli.py, following the shape of the existing changelog_gate / declared_deps siblings.
• Colocated unit tests (*_test.py, per AGENTS.md — suffix, never test_ prefix), mocking the filesystem and git ls-files. The internals-checks lane enforces a 100% unit-coverage floor and runs the mutation gate, so every branch needs an assertion that kills its mutant.
• Failure output must be actionable per AGENTS.md: name the protection, the workflow, the offending path, and which side to edit — not just "mismatch".

Red/green applies normally here. Unlike the rest of this epic, this is ordinary code: write the failing unit tests first, push them, confirm CI red for the right reason, then implement. The "the PR's own check list is the test" shortcut covers workflow triggering, which is not what this slice changes.

Wiring it into CI

Add .github/workflows/ci-paths-check.yml:

name: CI Paths

on:
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/**'
      - '.mergify.yml'
      - 'internals/checks/**'
      - '.github/workflows/ci-paths-check.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  ci-paths:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: astral-sh/setup-uv@v5
      - run: uv run --project internals/checks dirsql-checks ci-paths

(.github/workflows/** already covers the self-path; it is listed separately only for legibility — drop the duplicate if you prefer.)

Then add the matching gated anchor to .mergify.yml, following the phase-2 pattern:

  - name: CI Paths reported
    if:
      - base = main
      - or:
          - files ~= ^\.github/workflows/
          - files ~= ^\.mergify\.yml$
          - files ~= ^internals/checks/
    success_conditions:
      - "check-success = ci-paths"

The new check must pass against its own configuration — that anchor's if is an exact mirror of the workflow's paths:, so it satisfies the invariant by construction.

Expected checks on this PR

Files touched: internals/checks/**, .github/workflows/ci-paths-check.yml, .mergify.yml.

MUST run

• ci-paths — the new check, on itself
• internals-checks / … — internals/checks/** is its trigger
• Release Precheck — it runs dirsql-checks (release-precheck.yml:59, :88, :119), so internals/checks/** is in its filter (CI paths: Release Precheck — stop running on every PR #851)
• Changelog Check — same reason (changelog-check.yml:29, CI paths: Changelog Check — stop running on every PR #853)

MUST NOT run

• Python Test, TS Test, Rust Test, Plugins Test, Python Lint, Python Typecheck, TS Lint, TS Typecheck
• the seven non-internals-checks Conventions lanes
• Release Config Check

This is also the end-to-end confirmation of spec row 8 — an internals/checks/** change reaching exactly its three declared consumers and nothing else.

Acceptance

• Unit tests pushed red first, CI observed failing for the right reason, then implementation
• ci-paths passes against the post-epic .mergify.yml and workflow set
• Deliberately break one glob locally and confirm the check fails with an actionable message naming the protection, the workflow and the path
• The PR's check list matches the groups above exactly
• Mergify Merge Protections green
• Merge, close this issue and Epic — CI: run only the checks relevant to the changed paths #834

Notes

• No changelog fragment (internals/ is not packages/<pkg>/), no e2e attestation, no PARITY.md change.