Implement hash-based CI test cache invalidation

Goal

Implement hash-based test cache invalidation so incremental CI can safely write git notes without false positive cache hits.

Problem

Currently, incremental CI only tests changed files. If we wrote notes, a commit could appear to pass full CI when only 1 file was tested. Dependent files that might fail would never be caught.

Solution: Hash-based invalidation

Concept

A file's test is only valid if the file AND all its transitive dependencies haven't changed since the test ran.

Implementation

1. Compute "test hash" for each file: test-hash(Foo.hs) = sha256(content of Foo.hs + all transitive imports)

2. Store hash in git notes: Test-is: good Test-hash: a1b2c3d4... Test-files: Omni/Foo.hs

3. On CI run:

• Recompute test-hash for each file
• Compare to stored hash in notes
• If match → true cache hit, skip
• If mismatch → dependency changed, must re-test

Dependency Graph Requirements

Haskell: bild already parses imports via buildHsModuleGraph. Extend to:

• Return transitive closure of imports
• Hash file contents, not just paths

Python: Need to parse imports. Could use:

• AST parsing (import X, from X import Y)
• Or leverage existing detectPythonImports in Bild.hs

Nix: Harder due to dynamic imports. Options:

• Conservative: assume all .nix files depend on each other
• Parse import ./path.nix statements
• Track callPackage patterns

Changes needed

1. Omni/Bild.hs: Add getTransitiveDeps :: Namespace -> IO [Namespace] 2. Omni/Ci.hs:

• Compute test-hash before testing
• Check notes for matching hash
• Write hash to notes after test

3. Consider: Separate refs/notes/ci-hashes for hash data

Benefits

• Incremental CI can safely cache results
• Only re-test when actual dependencies change
• Faster CI without sacrificing correctness

Risks

• Incomplete dependency tracking → false cache hits
• Cross-language deps (Haskell calling Python) may be missed
• Template Haskell / CPP can hide deps