ci: reduce redundant runtime gates

Author: fforootd

.github/workflows/ci.yml

@@ -229,6 +229,7 @@ jobs:
           retention-days: 7
 
   go-smoke-test-embedded-postgres:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: depot-ubuntu-24.04-4
     timeout-minutes: 15
     needs: [goreleaser-snapshot]
@@ -335,6 +336,7 @@ jobs:
           node scripts/check-changeset-required.mjs --base "origin/${{ github.base_ref }}"
 
   quickstart-smoke:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: depot-ubuntu-24.04-4
     timeout-minutes: 20
     needs: [goreleaser-snapshot]
@@ -423,6 +425,7 @@ jobs:
           fi
 
   node-e2e:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: depot-ubuntu-24.04-4
     timeout-minutes: 15
     steps:
@@ -792,11 +795,17 @@ jobs:
     steps:
       - name: Check CI gate results
         env:
+          IS_PULL_REQUEST: ${{ github.event_name == 'pull_request' }}
           NEEDS_JSON: ${{ toJson(needs) }}
         run: |
           node <<'NODE'
           const needs = JSON.parse(process.env.NEEDS_JSON);
           const allowedSkipped = new Set(["changeset-check"]);
+          if (process.env.IS_PULL_REQUEST === "true") {
+            allowedSkipped.add("go-smoke-test-embedded-postgres");
+            allowedSkipped.add("quickstart-smoke");
+            allowedSkipped.add("node-e2e");
+          }
           const failed = Object.entries(needs).filter(([name, job]) => {
             if (job.result === "success") return false;
             if (job.result === "skipped" && allowedSkipped.has(name)) return false;

AGENTS.md

@@ -131,9 +131,9 @@ signaled and cleaned up directly.
 startup, then runs `go run .`. Direct `go run .` callers must sync the embed
 folders themselves or disable both embedded UI surfaces.
 
-End-to-end tests are **opt-in locally** — they're not part of the
-default `run-many -t lint,typecheck,build,test` invocation because they
-boot real dev servers and need browsers installed:
+Checked-in demo end-to-end tests are **opt-in locally** and main-only in CI.
+They are not part of the default `run-many -t lint,typecheck,build,test`
+invocation because they boot real dev servers and need browsers installed:
 
 ```sh
 corepack pnpm exec playwright install
@@ -159,11 +159,12 @@ Use `corepack pnpm run journey` for deterministic CI-style proof of the
 fresh-app path. Use `corepack pnpm run cli -- ...` for manual browser or agent
 experiments against the same local package train.
 
-In CI the dedicated `node-e2e` job (in `.github/workflows/ci.yml`) gates merges
-on the checked-in demo integrations. The separate `consumer-journey-e2e` job is
-the fresh-app quality gate: it consumes the current workflow's GoReleaser image
-and npm package artifacts instead of public Zitadel packages. Browsers are
-cached on the runner to reduce install cost.
+In CI the `consumer-journey-e2e` matrix is the required PR runtime gate: it
+consumes the current workflow's GoReleaser image and npm package artifacts
+instead of public Zitadel packages. The checked-in demo integrations
+(`node-e2e`), raw binary embedded-postgres smoke, and documented quick-start
+compose smoke run on pushes to `main` as release-surface confidence checks.
+Browsers are cached on the runner to reduce install cost.
 
 ## Testing Layers
 
@@ -333,7 +334,7 @@ Standard commands are documented in root `AGENTS.md` → **Local Checks** and
 
 - **Fast local checks:** `corepack pnpm run check`
 - **Full local checks:** `corepack pnpm run check -- --full`
-- **E2E:** `corepack pnpm nx run-many -t e2e -p @zitadel/demo-next-e2e,@zitadel/demo-nuxt-e2e`
+- **Demo E2E (manual/main-only):** `corepack pnpm run check -- --only node:e2e`
 - **Consumer journey E2E:** `corepack pnpm run journey`
 
 ### Running demo apps manually

docs/operations/env.example

@@ -1,5 +1,5 @@
 # Copy to .env next to docker-compose.yaml (see docs/quick-start/index.md).
-# On PR CI, quickstart-smoke overrides NEXTGEN_IMAGE with the Goreleaser snapshot tag.
+# On main CI, quickstart-smoke overrides NEXTGEN_IMAGE with the Goreleaser snapshot tag.
 
 NEXTGEN_IMAGE=ghcr.io/zitadel/nextgen:latest
 NEXTGEN_PORT=8080

scripts/check.mjs

@@ -16,8 +16,9 @@ const phases = new Map([
   ["release", phaseRelease],
   ["journey", phaseJourney],
 ]);
-const fullOrder = [...phases.keys()];
+const fullOrder = [...phases.keys()].filter((phase) => phase !== "node:e2e");
 const fastOrder = ["openapi", "go", "node"];
+const explicitOnlyPhases = [...phases.keys()].filter((phase) => !fullOrder.includes(phase));
 
 const options = parseArgs(forwardedArgs());
 const selected = options.only ? [options.only] : options.full ? fullOrder : fastOrder;
@@ -84,8 +85,11 @@ function usage(error) {
 
 Default is --fast.
 
-Phases:
+Full phases:
   ${fullOrder.join("\n  ")}
+
+Explicit-only phases:
+  ${explicitOnlyPhases.join("\n  ")}
 `);
   process.exit(error ? 1 : 0);
 }