ci: fence the test recipes and rebuild the pipelines around the gate set

Assisted-by: DeepSeek V4.1 Flash

.gitea/workflows/test.yml

@@ -1,23 +1,19 @@
 # Test, Go. Push and pull request to development. Never on main.
 #
-# The gates are the ones the justfile's `gates` recipe runs, minus race: the shared
-# runner box cannot afford the race detector on every push. Race has its own
-# pipeline, dispatched by hand, and the local `just gates` runs it once per
-# task. The box is one core and 2 GB beside Gitea, so
-# parallelism is bounded on purpose and everything runs in one job. Extra jobs would
-# duplicate the checkout, the Go setup and the dependency download three times without
-# buying any parallelism.
+# The push path owns a two-minute budget end to end, so it carries exactly the
+# gates that fit it: the format check, `go vet`, the suite's short layer and the
+# coverage floor. There is no build step (`go test` compiles what it runs) and
+# no install step: the fedora job image carries git, perl and node (verified on
+# the runner, 2026-10-04), and no pipeline ever installs gcc or runs the race
+# detector. The modernisation gate (`go fix -diff`) and the full suite live in
+# the suite workflow.
 #
-# Every step is one command, so the step that fails is the gate that failed, and no shell
-# option has to be trusted for the run to stop. The scripted steps are Perl, not shell and
-# not Python: Perl behaves the same on both runner images, there is no bashism to trip over
-# on ash, and it is one language instead of two. The Perl uses builtins only, because
-# Fedora packages the Perl modules separately and nothing beyond `perl` itself may be
-# assumed present.
+# A test too slow for the push budget marks itself with `testing.Short` and the
+# suite workflow runs it; the push path runs what fits its budget.
 #
-# After the gates runs the toml-test compliance suite, which is this library's conformance
-# record rather than a gate. It is fixed cases, not exploration, and it fits the box, so it
-# is none of the three burdens the push pipeline refuses: no fuzz, no race, no heavy sweep.
+# Every step is one command, so the step that fails is the gate that failed,
+# and no shell option has to be trusted for the run to stop. The scripted
+# steps are Perl with builtins only.
 name: Test
 
 on:
@@ -31,10 +27,10 @@ env:
   GOFLAGS: -p=1
   GOMAXPROCS: "2"
 
-# A superseded run of the same ref is cancelled instead of queueing behind one
-# that no longer matters. Verified on this Gitea on 2026-09-17: a queued run
-# whose ref moved on is cancelled before it ever reaches the runner, while a
-# run already dispatched there runs to completion.
+# A superseded run of the same ref is cancelled instead of queueing behind one that
+# no longer matters. Verified on Gitea 1.27.1 on 2026-09-17: a queued run whose ref
+# moved on is cancelled before it ever reaches the runner, while a run already
+# dispatched there runs to completion.
 concurrency:
   group: ${{ gitea.workflow }}-${{ gitea.ref }}
   cancel-in-progress: true
@@ -42,7 +38,6 @@ concurrency:
 jobs:
   test:
     runs-on: fedora
-    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
 
@@ -52,11 +47,6 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      - name: Install Perl
-        # The runner images are minimal and Perl is not guaranteed. The install is a
-        # no-op where it is already present; drop this step once verified on the box.
-        run: dnf install -y perl
-
       - name: Format
         run: |
           perl -e '
@@ -70,17 +60,14 @@ jobs:
       - name: Vet
         run: go vet ./...
 
-      - name: Modernise
-        # Exits non-zero when it has something to rewrite, so it needs no output capture.
-        run: go fix -diff ./...
-
-      - name: Build
-        run: go build ./...
-
       - name: Tests
-        # Scope the pattern to the packages that hold the logic when a thin cmd/ drags the
-        # total under the floor, and keep it equal to `packages` in the project's justfile.
-        run: go test -count=1 -timeout 10m -coverprofile=coverage.out ./...
+        # Equal to `packages` in the project's justfile, so the floor is the same
+        # number the local gate reports. The short layer is what runs; the
+        # persistent build cache on the runner makes a warm run seconds, not
+        # minutes. No timeout anywhere: `-timeout 0` disables go test's own
+        # ten-minute default, because a run that does not finish is a defect to
+        # find and a timeout only hides it.
+        run: go test -short -count=1 -timeout 0 -coverprofile=coverage.out ./...
 
       - name: Coverage floor
         run: |
@@ -93,21 +80,3 @@ jobs:
             printf qq{Total coverage: %s%%\n}, $total;
             exit($total < 80 ? 1 : 0);
           '
-
-      - name: Install toml-test
-        # A dev and CI tool only; it is not a module dependency of interpres. GOBIN pins
-        # the destination, so the later step invokes the tool by path and no command
-        # output has to be captured into a variable.
-        env:
-          GOBIN: ${{ gitea.workspace }}/bin
-        run: go install github.com/toml-lang/toml-test/v2/cmd/toml-test@v2.2.0
-
-      - name: Build the decoder
-        run: go build -o bin/interpres-decode ./cmd/interpres-decode
-
-      - name: Compliance suite
-        # interpres implements TOML 1.1, and the suite runs both directions: the decoder
-        # on the valid and invalid corpora, the encoder on the tagged JSON of the valid
-        # one. The mode is pinned so an upstream default change cannot silently move the
-        # corpus.
-        run: bin/toml-test test -decoder=bin/interpres-decode -encoder='bin/interpres-decode -encode' -toml=1.1