test(ci): speed up cli-tests by sharding testscripts across runners

[mikeland73]

Summary

The cli-tests test job is dominated by the testscripts package (~380s wall). Two changes cut that down: (1) shard the testscripts across runners — they are bound by per-runner nix work (downloading ~677 package closures and evaluating flakes on each devbox invocation), which funnels through a single nix-daemon and does not parallelize within one runner, so a shard: [0, 1, 2] matrix axis splits the scripts (round-robin over a sorted list, so heavy scripts spread evenly) across three runners that each have their own daemon/cores/network; and (2) swap the add_insecure testscript from python@2.7.18.6 (not cached, compiled from source, ~260s — the single longest script) to nodejs@16 (16.20.2), which is flagged insecure in the pinned nixpkgs (Node 16 is EOL) yet has a prebuilt binary on cache.nixos.org, so it still exercises the --allow-insecure flow but substitutes in seconds. A test-result job aggregates the shards into one stable status check.

⚠️ Branch protection: the shard axis renames the matrix jobs (e.g. test (not-main, ubuntu-latest, project-tests-off, 0)), so required-check names change — point branch protection at the new test-result check. Note test-result aggregates the whole matrix, including project-tests-only (previously treated as a non-required signal); tell me if you'd rather keep that non-blocking.

How was it tested?

Confirmed the in-tree add_insecure swap passes through the go test harness locally (28s vs 260s) and verified via nix eval that nodejs_16 carries knownVulnerabilities in the pinned nixpkgs. Confirmed sharding partitions scripts disjointly across DEVBOX_TEST_SHARD_INDEX=0/1/2 locally, and that the split is balanced (~20/20/19 scripts, heavy scripts spread across all shards). go build, go vet, gofumpt, and golangci-lint pass on the changed packages.

Community Contribution License

All community contributions in this pull request are licensed to the project
maintainers under the terms of the
Apache 2 License.

By creating this pull request, I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 License as stated in
the
Community Contribution License.

[Copilot]

Pull request overview

This pull request speeds up the cli-tests GitHub Actions workflow by increasing Go test concurrency and replacing a slow “insecure package” test target with a cached (but still insecure/EOL) alternative, reducing overall CI wall-clock time for the CLI test suite.

Changes:

• Run Go tests with -parallel 8 in CI for the fast test leg to increase overlap of I/O-bound testscript work.
• Add -parallel 8 to the test-projects-only devbox script so the slow/project test leg matches the same concurrency tuning.
• Update the insecure-package testscript to use nodejs@16 (cached) instead of python@2.7.18.6 (source build), while still exercising --allow-insecure.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
testscripts/add/add_insecure.tst.txt	Switches the insecure package under test to a cached Node 16 derivation and documents the rationale.
devbox.json	Adds -parallel 8 to the test-projects-only script to speed up project testscripts.
.github/workflows/cli-tests.yaml	Adds -parallel 8 to the fast go test invocation and documents why oversubscription helps on CI runners.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.