ci(release-plz): run the auth refresh soak only on an armed crates line

The long soak ran on every push matching release-plz.yml's path filter,
even when the stack-* crates line is not armed and release-crates is
skipped anyway. Give it the same crates-armed gate as release-crates.

It still runs before release-crates' preflight asks crates.io whether any
version is unpublished, so a failed soak also holds stack-kms and
stack-encrypt. Moving that preflight into its own job would let the soak
run only for an unpublished stack-auth, but release-crates would then need
a status function to run past a skipped soak, which the soak gate test
forbids on the publish job. Left as is.

eql-pipeline-armed.test.mjs pins exactly which jobs the switch gates; it
now lists the soak beside the publish job.

Author: coderdan

.github/workflows/release-plz.yml

@@ -225,8 +225,14 @@ jobs:
         id: armed
         run: node scripts/eql-pipeline-armed.mjs crates
 
+  # Gated on the switch so an unarmed line spends nothing on the soak. It
+  # still runs on every armed push, before release-crates' preflight decides
+  # whether any crate is unpublished, so a failed soak holds stack-kms and
+  # stack-encrypt too.
   auth-refresh-soak:
     name: Auth refresh cancellation soak before publishing
+    needs: [crates-armed]
+    if: needs.crates-armed.outputs.armed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:

scripts/__tests__/auth-refresh-soak-ci.test.mjs

@@ -40,7 +40,11 @@ describe('auth refresh cancellation soak gates', () => {
     expect(
       gate.steps.find((step) => step.name === 'Long seeded soak').run,
     ).toBe('mise run test:soak:stack-auth')
-    expect(gate.if).toBeUndefined()
+    // Only an armed line runs the soak; release-crates needs the same switch,
+    // so a skipped soak never stands in front of a publish.
+    expect(gate.needs).toEqual(['crates-armed'])
+    expect(gate.if).toBe("needs.crates-armed.outputs.armed == 'true'")
+    expect(release.jobs['release-crates'].if).toBe(gate.if)
     expect(release.jobs['release-crates'].needs).toContain('auth-refresh-soak')
     // No status function bypasses the implicit success() dependency check.
     expect(release.jobs['release-crates'].if).not.toMatch(

scripts/__tests__/eql-pipeline-armed.test.mjs

@@ -163,7 +163,12 @@ describe('every EQL publish job reads it', () => {
  */
 const CRATES_PACKAGE = '@cipherstash/auth'
 const CRATES_WORKFLOW = '.github/workflows/release-plz.yml'
-const CRATES_GATED_JOBS = [`${CRATES_WORKFLOW} / release-crates`]
+// The publish job, and the auth refresh soak it needs: an unarmed line has
+// nothing to publish, so it has nothing to soak either.
+const CRATES_GATED_JOBS = [
+  `${CRATES_WORKFLOW} / auth-refresh-soak`,
+  `${CRATES_WORKFLOW} / release-crates`,
+]
 
 describe('the stack-* crates line', () => {
   it('keys on the @cipherstash/auth entry', () => {
@@ -212,7 +217,7 @@ describe('the stack-* crates line', () => {
     }
   })
 
-  it('is computed by release-plz.yml and gates exactly the crates publish job', () => {
+  it('is computed by release-plz.yml and gates exactly the crates publish job and its soak', () => {
     const job = readWorkflow(CRATES_WORKFLOW)?.jobs?.['crates-armed']
     const runsIt = (job?.steps ?? []).some((step) =>
       String(step?.run ?? '').includes('scripts/eql-pipeline-armed.mjs crates'),