From fe246e4a0a14a4ce154e05e52188bac098dea80c Mon Sep 17 00:00:00 2001
From: Chinesezjc <jczhai@deepseek.com>
Date: Mon, 27 Jul 2026 15:17:48 +0800
Subject: [PATCH] =?UTF-8?q?ci:=20failover=20round=20=E2=80=94=20aggregate?=
 =?UTF-8?q?=20follows=20the=20selector,=20tighter=20shared-VM=20bounds?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- all-checks-passed now resolves its pool through the same
  DSH_CI_FAILOVER expression as the worker jobs it aggregates.
  Pinned to the hosted pool it would leave the branch-protection
  verdict queued on the failed pool after every failover job passed —
  observed live during the 2026-07-27 outage as a required check
  looping against dead capacity.
- Coverage worker bound under failover drops 12 → 8 and snapshot
  concurrency 16 → 12: the pool now runs six always-on instances (the
  spare tier was retired), so worst case is 6 × 8 = 48 coverage
  workers on the shared 64-core VM.
---
 .github/workflows/ci.yml | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5afa5d7f62..df3d386e39 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,11 +102,12 @@ jobs:
           || 'dsh-enterprise-ubuntu-24-04-32core-test' }}
     name: node 24 / coverage
     env:
-      # Failover halves the worker bound: the hosted 32-core runner is
+      # Failover shrinks the worker bound: the hosted 32-core runner is
       # exclusive to one job, but the failover pool shares one 64-core VM
-      # across four runner instances, and the timing-sensitive process
-      # suites have documented aggregate-contention failures.
-      DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && '12' || '24' }}
+      # across six always-on runner instances, and the timing-sensitive
+      # process suites have documented aggregate-contention failures.
+      # 8 × 6 instances = 48 workers worst case on 64 cores.
+      DSH_COVERAGE_MAX_WORKERS: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && '8' || '24' }}
       DSH_GATE_CONCURRENCY: '8'
     steps:
       - uses: actions/checkout@v6
@@ -160,7 +161,7 @@ jobs:
       DSH_NODE_COMPAT_SKIP_TYPECHECK: '1'
       DSH_PUBLINT_CONCURRENCY: '8'
       # Failover halves snapshot concurrency for the shared 64-core VM.
-      DSH_SNAPSHOT_MAX_CONCURRENCY: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && '16' || '32' }}
+      DSH_SNAPSHOT_MAX_CONCURRENCY: ${{ vars.DSH_CI_FAILOVER == 'selfhosted' && '12' || '32' }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -765,8 +766,15 @@ jobs:
   # 'cancelled' and 'skipped'.
   all-checks-passed:
     name: all checks passed
-    # The required verdict must not add a separate standard-hosted billing dependency.
-    runs-on: dsh-enterprise-ubuntu-latest-32core-test
+    # The required verdict must not add a separate standard-hosted billing
+    # dependency — and it must follow the failover selector like the worker
+    # jobs it aggregates: if it stayed pinned to the hosted pool, every
+    # failover-passed run would still leave the branch-protection verdict
+    # queued forever on the failed pool.
+    runs-on: >-
+      ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
+          && fromJSON('["self-hosted", "linux", "x64", "vm-backup"]')
+          || 'dsh-enterprise-ubuntu-latest-32core-test' }}
     needs: [node-24, node-24-coverage, node-24-consumers, node-compat, python-sdk, windows]
     if: always() && github.event_name == 'pull_request'
     steps: