From d5c4477a76bdacdbf96385cc4de69d8b06116c3b Mon Sep 17 00:00:00 2001
From: Josh Knapp <jknapp85@gmail.com>
Date: Mon, 12 Oct 2026 10:08:07 -0700
Subject: [PATCH] CI: consolidate matrix into a single job to spare the shared
 runner pool

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml | 74 ++++++++++++++++-------------------------
 1 file changed, 29 insertions(+), 45 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 613b4195d..2a87c5290 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -8,59 +8,43 @@ on:
   schedule:
     - cron: "17 5 * * *" # nightly vuln rescan
 
+# One job on purpose: the shared runner pool is small, so all modules are
+# checked sequentially on a single runner instead of a 15-way matrix.
 jobs:
-  modules:
-    name: ${{ matrix.module }}
+  check:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        module:
-          - .
-          - api
-          - sdk
-          - plugins/boundary/mains/aws
-          - plugins/boundary/mains/azure
-          - plugins/boundary/mains/gcp
-          - plugins/boundary/mains/minio
-          - plugins/kms/mains/alicloudkms
-          - plugins/kms/mains/awskms
-          - plugins/kms/mains/azurekeyvault
-          - plugins/kms/mains/gcpckms
-          - plugins/kms/mains/ibmkp
-          - plugins/kms/mains/ocikms
-          - plugins/kms/mains/transit
+    timeout-minutes: 90
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: .go-version
           cache: false
-      - name: build
-        working-directory: ${{ matrix.module }}
-        run: go build ./...
-      - name: vet
-        working-directory: ${{ matrix.module }}
-        run: go vet -composites=false ./...  # composites: pre-existing upstream test-file warnings
-      - name: govulncheck
-        working-directory: ${{ matrix.module }}
+      - name: install scanners
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
-          "$(go env GOPATH)/bin/govulncheck" ./...
-      - name: unit tests (api, sdk only; root needs Postgres)
-        if: matrix.module == 'api' || matrix.module == 'sdk'
-        working-directory: ${{ matrix.module }}
-        run: go test ./...
-
-  osv:
-    name: osv-scanner
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: .go-version
-          cache: false
-      - run: |
           go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
-          "$(go env GOPATH)/bin/osv-scanner" scan source -r .
+      - name: build, vet, govulncheck, tests per module
+        shell: bash
+        run: |
+          export PATH="$(go env GOPATH)/bin:$PATH"
+          modules=$(find . -name go.mod -printf '%h\n' | sort)
+          failed=()
+          for m in $modules; do
+            echo "::group::$m"
+            (
+              set -e
+              cd "$m"
+              go build ./...
+              # composites: pre-existing upstream test-file warnings
+              go vet -composites=false ./...
+              govulncheck ./...
+              case "$m" in ./api|./sdk) go test ./... ;; esac  # root needs Postgres
+            ) || failed+=("$m")
+            echo "::endgroup::"
+          done
+          if [ ${#failed[@]} -gt 0 ]; then
+            echo "FAILED modules: ${failed[*]}"; exit 1
+          fi
+      - name: osv-scanner
+        run: osv-scanner scan source -r .