ci: scope the build matrix and the HIL run to what a PR affects

Every PR built all 74 legs (2494 example builds on GHA cmake alone) and flashed
all 30 rig boards, whatever it touched. One classifier now walks the PR diff twice
and answers three questions: which families to build, which examples per family,
and which boards run which tests. Fail-open throughout - anything no rule
classifies, any exception, any unusable output falls back to the full matrix, and
a master push always builds everything.

test/hil/helper/hil_select.py moves to tools/ci_select.py: it is no longer HIL-only,
and tools/ is where the build side can import it. test_hil_select.py follows it as
test_ci_select.py.

Rules (docs/superpowers/specs/2026-08-19-ci-build-family-filter-design.md holds the
full table): a port selects the families whose family.cmake references it, and its
role - a dcd change skips host examples and vice versa; a class selects only the
examples whose tusb_config.h enables its CFG_TU[DH]_ macro, following cross-class
includes; an example selects itself; hw/bsp selects its family or board; hw/mcu and
lib select whoever references them. CMake is the reference for all of it - make
follows whatever cmake decides, family.mk is never scanned.

Empty means empty (maintainer ruling): a rule that classifies a path to nothing
selects nothing. Ports no family references, classes no config enables, libs no
example builds and hw/mcu paths that resolve nowhere are all real - nothing
compiles them, so nothing can validate them, and the master-push build is the net.
Structural tests pin each such case with an explicit allowlist, so the day one
stops being empty it fails pre-commit instead of silently narrowing CI.

Per-example builds: build.py grows a repeatable -e, resolved against the targets
CMake actually registered and batched into one `cmake --build --target a b c`.
build_utils mirrors CMake's family_filter (the whole FAMILY_MCUS list, ${...} and
string(TOUPPER ...) resolved) for the cmake side, while the make side keeps
master's algorithm verbatim - the two build systems answer differently and a shared
answer breaks lpc54's make link. hil-build gains this even on a full selection:
1702 example builds become 515.

Transport: the selection travels as a file, never an argv or env var - a mass-sweep
diff selects 261 KB against a 128 KiB exec limit, and E2BIG would fail the step
before its own fallback could run. CircleCI carries the example map inside the
generated config (pipeline parameters cap at 512 chars), swapped into the parameter
defaults by sentinel match, and drops the scoping wholesale if that rewrite fails.
Every PR-derived value written to $GITHUB_ENV/$GITHUB_OUTPUT is character-screened.

Code metrics follow the scoping: metrics.py emits per-example totals, and
metrics_pair_compare compares the (board, example) pairs present on both sides
instead of a scoped run against a full-matrix average.

The selector's own suite gates it in both providers: a selector that exits 0 with
valid-but-wrong JSON is the one failure fail-open cannot catch, so a red suite
means the full matrix.

1 files changed, 44 insertions, 3 deletions

diff --git a/.github/scripts/hil_ci_set_matrix.py b/.github/scripts/hil_ci_set_matrix.py
index 65f50788e..396c4175a 100644
--- a/.github/scripts/hil_ci_set_matrix.py
+++ b/.github/scripts/hil_ci_set_matrix.py
@@ -1,6 +1,7 @@
 import argparse
 import json
 import os
+import sys
 
 
 def _resolve_config_path(config_file):
@@ -19,13 +20,47 @@ def _resolve_config_path(config_file):
 def main():
     parser = argparse.ArgumentParser()
     parser.add_argument('config_files', nargs='+', help='Configuration JSON file(s)')
-    parser.add_argument('--select', help='hil_select.py JSON; scopes boards when full=false')
+    g = parser.add_mutually_exclusive_group()
+    g.add_argument('--select', help='ci_select.py JSON; scopes boards when full=false')
+    # a whole selection as one argv can exceed MAX_ARG_STRLEN on a big diff, which
+    # would fail the step instead of falling open; callers that already have the
+    # selection on disk pass the path instead
+    g.add_argument('--select-file', help='file holding the same JSON as --select')
     args = parser.parse_args()
 
+    raw = args.select
+    sel = None
+    try:
+        if args.select_file:
+            with open(args.select_file) as f:
+                raw = f.read()
+        if raw:
+            sel = json.loads(raw)
+        if sel is not None and not isinstance(sel, dict):
+            raise ValueError(f'selection is {type(sel).__name__}, not an object')
+    except Exception as e:  # fail-open: an unusable selection must never red the job
+        print(f'hil_ci_set_matrix: selection unusable ({e}) - full roster',
+              file=sys.stderr)
+        sel = None
+
     selected = None
-    sel = json.loads(args.select) if args.select else None
     if sel and not sel.get('full'):
-        selected = set(sel.get('boards', {}))
+        # key ABSENT is an unusable selection, not "nothing selected" - same reading as
+        # ci_set_matrix.py. Filtering every board out would skip every hil-build leg and,
+        # through needs:, both rig jobs: an all-green PR with zero hardware coverage.
+        # An explicit boards: {} stays a legitimate nothing-selected.
+        if not isinstance(sel.get('boards'), dict):
+            print('hil_ci_set_matrix: selection has full false but no usable boards '
+                  'map - full roster', file=sys.stderr)
+            sel = None          # ALL of it is unusable, hil_examples included: keeping
+                                # the -e lists would build a few examples per board
+                                # while the rig, unfiltered, runs that board's whole
+                                # test list - flash failures on the fail-open path
+        else:
+            selected = set(sel['boards'])
+    ex_map = (sel or {}).get('hil_examples') or {}
+    if not isinstance(ex_map, dict):
+        ex_map = {}
 
     # Toolchain buckets must match the toolchains instantiated by the hil-build
     # job in .github/workflows/build.yml. Keep all keys present (even if empty)
@@ -71,6 +106,12 @@ def main():
             if 'build' in board and 'args' in board['build']:
                 build_board += ' ' + ' '.join(f'-D{a}' for a in board['build']['args'])
 
+            # PR selection: build only the examples this board will run (its test
+            # list plus device/board_test, the parking firmware) - tools/build.py -e.
+            # Absent key (hand runs, full non-PR builds) keeps --target all.
+            for ex in ex_map.get(name, []):
+                build_board += f' -e {ex}'
+
             # Each variant builds into cmake-build-<variant.name> with its own cmake
             # -D defines and raw CFLAGS. No 'variant' -> a single build named after
             # the board.