feat(ci): reap stale CI workspaces and template versions on staging

[rfay]

Problem

cancel-in-progress only frees a GitHub runner — it does nothing to staging-coder.ddev.com. Each integration-test run pushes a template version and creates a workspace (owned by ci-bot), and the per-run coder delete / archive cleanup lives in if: always() steps inside the test job. When a run is cancelled (new push to a PR), force-killed, or its workspace lands in Failed, those steps never reach the server. Over many PR pushes, staging backs up with orphaned running workspaces (e.g. the same test from runs 151/152/154 all alive at once) and accumulated template versions (60+ per template).

Fix

Cleanup decoupled from any individual test job's fate, in three layers:

1. Scheduled janitor — new .github/workflows/ci-reap.yml + scripts/ci-reap-staging.sh. Every 15 min (and on demand via workflow_dispatch with age_minutes/dry_run inputs), authenticating as ci-bot, it deletes any ci-bot workspace that is failed/stopped/canceled (any age) or running past a threshold (default 20m), skipping transitional states, then runs coder templates archive <t> --all on all four templates. This is the safety net — it also handles merged/closed/abandoned PRs where no replacement run ever comes.

2. Reap-on-start — scripts/ci-reap-family.sh, wired into every active test job before coder create. The replacement run deletes its own name-family predecessors (e.g. gc-pathauto-d11-*) left behind by the cancelled run, giving immediate "new commit stops the old deployment."

3. Lighter PR matrix — on pull_request, drupal-core runs D12 only (+ the single fork job) and drupal-contrib runs one module; push-to-main and nightly keep the full matrix.

Notes

• The janitor's schedule: trigger only begins firing once ci-reap.yml is on main. Until then it can be run from the Actions tab or locally via ./scripts/ci-reap-staging.sh --force.
• Age logic relies on GNU date -d, which the ubuntu-latest runner provides (verified against ubuntu:24.04).
• ci-bot exclusively owns CI workspaces (real users are not ci-bot), so owner == ci-bot is a safe selector.
• This branch also includes a pre-existing commit (Add zellij to brew) that was already present before these changes.

Validation

• bash syntax + YAML parse on all four workflows
• Read-only dry run against staging: found 9 immediately-reapable failed/stopped workspaces, correctly kept 29 in-progress ones.

🤖 Generated with Claude Code

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-06-29 21:55 UTC