CI job display names¶

This document defines the naming convention and inventory of GitHub Actions CI job display names across .github/workflows/.

Naming convention¶

CI job and matrix display names (name:) conform to the following guidelines:

1. Length budget: All job display names target \(\le 30\) characters for legible rendering in GitHub's check-run list, mobile views, and CLI tools (gh pr checks).
2. Concise identifiers: Redundant parentheticals, verbose descriptive suffixes, and inline policy or ADR citations (e.g. (ADR-0108), (D24), (CERT C ENV33-C / JPL Rule 5)) are removed. The governing ADR or standard remains documented in workflow comments and repository documentation rather than the check name itself.
3. Discriminative qualifiers: Essential matrix qualifiers remain intact in compact form (e.g. Sanitizers (address), CodeQL (C/C++), Tidy SYCL).
4. Platform consistency: Operating system matrix legs follow a uniform prefix pattern (e.g. Ubuntu gcc+DNN, Ubuntu clang+DNN, Ubuntu HIP, Windows UCRT64, Windows MSVC+CUDA, Windows MSVC+SYCL).

Workflow display names (ADR-1227)¶

The same \(\le 30\) character budget applies to workflow-level name: fields, for a sharper reason: GitHub's badge.svg endpoint paints the workflow name into the badge, so the status badges at the top of README.md render whatever the workflow is called. Names like Tests & Quality Gates — Netflix Golden / Sanitizers / Tiny AI / Coverage (72 characters) turned those badges into banners that wrapped the README header across several lines.

The workflows the README badges point at are named exactly as their badge link labels (Tests, Builds, Lint, Security, FFmpeg) so the badge text and the link text agree.

The axis list a workflow used to carry in its name lives in a comment directly under the name: line instead, where it does not have to fit in a badge:

name: Security
# Security — Semgrep / CodeQL / Gitleaks / Dependency Review.
# The display name is deliberately short: GitHub's badge.svg paints it
# into the README status badge. See ADR-1227.

Filenames are not part of this budget. Badge and Actions URLs are keyed on the filename, so filenames stay purpose-descriptive kebab-case per ADR-0116 §1 — renaming one means re-pointing every badge.

Aggregator gating¶

Branch protection targets a single context: Required Checks Aggregator in .github/workflows/required-aggregator.yml. The aggregator's required array holds 89 check names. It declares both Scorecard event gates, then removes the non-applicable one, so a pull-request run evaluates 88 names, with only Scorecard PR Gate among the two. A run on a push also removes Release Dry Run (list pullRequestOnly, ADR-1687: its workflow has no push trigger) and evaluates 87. A name that no run reported is accepted unless it is in a must-report list of the aggregator (ADR-0313, ADR-1297).

A required name must be reported by exactly one job, because the aggregator keeps one check run per name, so two jobs sharing a name can mask each other's failure. scripts/ci/check-aggregator-names.sh enforces it. The build.yml Windows row used to share Windows MSVC+CUDA with the required libvmaf-build-matrix.yml lane and is now Windows MSVC+CUDA (full) (ADR-1259).

To prevent drift between workflow job definitions and the aggregator's required check array, all required checks are tagged in their defining workflow with # required-aggregator and verified by scripts/ci/check-aggregator-names.sh. The gate is wired into:

• make lint-sh
• .pre-commit-config.yaml (check-aggregator-names hook)
• the rule-enforcement.yml job Required check names have one reporter each, which also runs its self-test scripts/ci/tests/test-check-aggregator-names.sh

Complete mapping table¶

"Previous Name" is the display name before PR #1286 (f93a0037f) shortened it; "unchanged" means that PR did not rename the job. The table covers the jobs that PR renamed and later additions; the required array of required-aggregator.yml is the complete list of required names. The "Required" column mirrors that array.