Sync develop into main: Portfolio Intelligence 2.0 release

.github/workflows/backend-integration.yml

@@ -9,13 +9,21 @@ on:
       - master
 
 jobs:
+  route:
+    uses: ./.github/workflows/route.yml
+    secrets: inherit
+    with:
+      plan: '{"backend_integration":"docker"}'
+      config_ref: 1dd19289af21f4f6be01f874390a180b3af8bb38
+
   backend-integration:
+    needs: route
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"
     strategy:
       matrix:
         node: ["24.13.0"]
       fail-fast: false
-    runs-on: runs-on=${{ github.run_id }}-backend_integration/runner=universe-hosted/cpu=2+8/env=production
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).backend_integration }}
     env:
       COMPOSE_PROJECT_NAME: mempool-integration-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
       MEMPOOL_TEST_BASE_CONFIG_FILE: ${{ github.workspace }}/${{ matrix.node }}/integration/backend/mempool-config.test.json

.github/workflows/ci.yml

@@ -9,14 +9,22 @@ on:
       - master
 
 jobs:
+  route:
+    uses: ./.github/workflows/route.yml
+    secrets: inherit
+    with:
+      plan: '{"backend":"light","cache":"light","frontend":"light","e2e":"light","validate_docker_json":"light"}'
+      config_ref: 1dd19289af21f4f6be01f874390a180b3af8bb38
+
   backend:
+    needs: route
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"
     strategy:
       matrix:
         node: ["24.13.0"]
         flavor: ["dev", "prod"]
       fail-fast: false
-    runs-on: runs-on=${{ github.run_id }}-backend/runner=universe-hosted/cpu=2+8/env=production
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).backend }}
 
     name: Backend (${{ matrix.flavor }}) - node ${{ matrix.node }}
     steps:
@@ -97,11 +105,12 @@ jobs:
 
 
   cache:
+    needs: route
     name: "Cache assets for builds"
     strategy:
       matrix:
         node: ["24.13.0"]
-    runs-on: runs-on=${{ github.run_id }}-cache/runner=universe-hosted/cpu=2+8/env=production
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).cache }}
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -205,14 +214,14 @@ jobs:
           key: promo-video-assets-cache
 
   frontend:
-    needs: cache
+    needs: [route, cache]
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"
     strategy:
       matrix:
         node: ["24.13.0"]
         flavor: ["dev", "prod"]
       fail-fast: false
-    runs-on: runs-on=${{ github.run_id }}-frontend/runner=universe-hosted/cpu=2+8/env=production
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).frontend }}
 
     name: Frontend (${{ matrix.flavor }}) - node ${{ matrix.node }}
     steps:
@@ -309,8 +318,8 @@ jobs:
 
   e2e:
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"
-    runs-on: runs-on=${{ github.run_id }}-e2e/runner=universe-hosted/cpu=2+8/env=production
-    needs: frontend
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).e2e }}
+    needs: [route, frontend]
     strategy:
       fail-fast: false
       matrix:
@@ -452,8 +461,9 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CYPRESS_PROJECT_ID: ${{ secrets.CYPRESS_PROJECT_ID }}
   validate_docker_json:
+    needs: route
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"
-    runs-on: runs-on=${{ github.run_id }}-validate_docker_json/runner=universe-hosted/cpu=2+8/env=production
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).validate_docker_json }}
     name: Validate generated backend Docker JSON
 
     steps: 

.github/workflows/docker.yml

@@ -18,9 +18,17 @@ permissions:
   contents: read
 
 jobs:
+  route:
+    uses: ./.github/workflows/route.yml
+    secrets: inherit
+    with:
+      plan: '{"test_images":"docker","build":"docker","tag_latest":"docker"}'
+      config_ref: 1dd19289af21f4f6be01f874390a180b3af8bb38
+
   test-images:
+    needs: route
     # Always run on tag pushes and all pull requests
-    runs-on: runs-on=${{ github.run_id }}-test_images/runner=universe-hosted/cpu=2+8/env=production
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).test_images }}
     timeout-minutes: 30
     name: Test built Docker images
     steps:
@@ -222,7 +230,7 @@ jobs:
           docker compose -f docker-compose.test.yml down -v
 
   build:
-    needs: test-images
+    needs: [route, test-images]
     # Run on tag pushes OR on PRs with "docker-push" label (after test-images passes)
     if: |
       needs.test-images.result == 'success' &&
@@ -233,7 +241,7 @@ jobs:
         service:
           - frontend
           - backend
-    runs-on: runs-on=${{ github.run_id }}-build/runner=universe-hosted/cpu=2+8/env=production
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).build }}
     timeout-minutes: 120
     name: Build and push to DockerHub
     outputs:
@@ -360,10 +368,10 @@ jobs:
           ./${{ matrix.service }}/
 
   tag-latest:
-    needs: build
+    needs: [route, build]
     # Only for successful tag pushes (not PRs with docker-push label) and only for "plain" versions (no '-')
     if: ${{ needs.build.result == 'success' && github.event_name == 'push' && !contains(github.ref_name, '-') }}
-    runs-on: runs-on=${{ github.run_id }}-tag_latest/runner=universe-hosted/cpu=2+8/env=production
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).tag_latest }}
     timeout-minutes: 30
     name: Tag release build as latest
     strategy:

.github/workflows/e2e_parameterized.yml

@@ -20,9 +20,17 @@ on:
         type: string 
 
 jobs:
+  route:
+    uses: ./.github/workflows/route.yml
+    secrets: inherit
+    with:
+      plan: '{"cache":"light","e2e":"light"}'
+      config_ref: 1dd19289af21f4f6be01f874390a180b3af8bb38
+
   cache:
+    needs: route
     name: "Cache assets for builds"
-    runs-on: runs-on=${{ github.run_id }}-cache/runner=universe-hosted/cpu=2+8/env=production
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).cache }}
     steps:
       - name: Determine checkout ref
         id: determine-ref
@@ -123,8 +131,8 @@ jobs:
           key: promo-video-assets-cache
 
   e2e:
-    runs-on: runs-on=${{ github.run_id }}-e2e/runner=universe-hosted/cpu=2+8/env=production
-    needs: cache
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).e2e }}
+    needs: [route, cache]
     strategy:
       fail-fast: false
       matrix:

.github/workflows/get_backend_block_height.yml

@@ -3,8 +3,16 @@ name: 'Check if servers are in sync'
 on: [workflow_dispatch]
 
 jobs:
+  route:
+    uses: ./.github/workflows/route.yml
+    secrets: inherit
+    with:
+      plan: '{"print_backend_sha":"light"}'
+      config_ref: 1dd19289af21f4f6be01f874390a180b3af8bb38
+
   print-backend-sha:
-    runs-on: runs-on=${{ github.run_id }}-print_backend_sha/runner=universe-hosted/cpu=2+8/env=production
+    needs: route
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).print_backend_sha }}
     name: Get block height
     steps:
       - name: Checkout

.github/workflows/get_backend_hash.yml

@@ -3,8 +3,16 @@ name: 'Print backend hashes'
 on: [workflow_dispatch]
 
 jobs:
+  route:
+    uses: ./.github/workflows/route.yml
+    secrets: inherit
+    with:
+      plan: '{"print_backend_sha":"light"}'
+      config_ref: 1dd19289af21f4f6be01f874390a180b3af8bb38
+
   print-backend-sha:
-    runs-on: runs-on=${{ github.run_id }}-print_backend_sha/runner=universe-hosted/cpu=2+8/env=production
+    needs: route
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).print_backend_sha }}
     name: Print backend hashes
     steps:
       - name: Checkout

.github/workflows/get_image_digest.yml

@@ -9,8 +9,16 @@ on:
         default: 'latest'
         type: string 
 jobs:
+  route:
+    uses: ./.github/workflows/route.yml
+    secrets: inherit
+    with:
+      plan: '{"print_images_sha":"light"}'
+      config_ref: 1dd19289af21f4f6be01f874390a180b3af8bb38
+
   print-images-sha:
-    runs-on: runs-on=${{ github.run_id }}-print_images_sha/runner=universe-hosted/cpu=2+8/env=production
+    needs: route
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).print_images_sha }}
     name: Print digest for images
     steps:
       - name: Checkout

.github/workflows/project-review-status.yml

@@ -11,8 +11,16 @@ on:
     types: [opened]
 
 jobs:
+  route:
+    uses: ./.github/workflows/route.yml
+    secrets: inherit
+    with:
+      plan: '{"manage_project_board":"light"}'
+      config_ref: 1dd19289af21f4f6be01f874390a180b3af8bb38
+
   manage-project-board:
-    runs-on: runs-on=${{ github.run_id }}-manage_project_board/runner=universe-hosted/cpu=2+8/env=production
+    needs: route
+    runs-on: ${{ fromJSON(needs.route.outputs.targets).manage_project_board }}
     steps:
       - name: Update Project Board
         uses: actions/github-script@v7

.github/workflows/route.yml

@@ -0,0 +1,91 @@
+name: Capacity route
+
+# Public repositories cannot call reusable workflows from a private
+# repository. This small local adapter keeps the reviewed routing logic and
+# configuration private: it fetches the four pinned router files at runtime,
+# then returns the same dynamic self-hosted/WarpBuild targets to its caller.
+
+on:
+  workflow_call:
+    inputs:
+      plan:
+        description: JSON object mapping job key to runner class.
+        required: true
+        type: string
+      config_ref:
+        description: Immutable .github-private commit holding the routing configuration.
+        required: true
+        type: string
+    outputs:
+      targets:
+        description: JSON object mapping job key to a resolved runs-on value.
+        value: ${{ jobs.route.outputs.targets }}
+    secrets:
+      UNIVERSE_ROUTER_TOKEN:
+        description: Token with organization runner read and .github-private contents access.
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  route:
+    name: route
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, universe-router]
+    timeout-minutes: 5
+    outputs:
+      targets: ${{ steps.route.outputs.targets }}
+    steps:
+      - name: Fetch pinned routing configuration
+        shell: pwsh
+        env:
+          ROUTER_TOKEN: ${{ secrets.UNIVERSE_ROUTER_TOKEN }}
+          CONFIG_REF: ${{ inputs.config_ref }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $files = @(
+            '.github/runner-classes.json',
+            '.github/scripts/route-runners.mjs',
+            '.github/scripts/lib/route-core.mjs',
+            '.github/scripts/lib/route-api.mjs'
+          )
+          $checkout = Join-Path $env:RUNNER_TEMP "router-config-$env:GITHUB_RUN_ID"
+          $credential = [Convert]::ToBase64String(
+            [Text.Encoding]::ASCII.GetBytes("x-access-token:$env:ROUTER_TOKEN")
+          )
+          $env:GIT_CONFIG_COUNT = '1'
+          $env:GIT_CONFIG_KEY_0 = 'http.extraHeader'
+          $env:GIT_CONFIG_VALUE_0 = "Authorization: Basic $credential"
+          $env:GIT_TERMINAL_PROMPT = '0'
+          try {
+            New-Item -ItemType Directory -Force -Path $checkout | Out-Null
+            git -C $checkout init --quiet
+            git -C $checkout remote add origin https://github.com/bitcoinuniverseio/.github-private.git
+            git -C $checkout config core.sparseCheckout true
+            $sparse = Join-Path $checkout '.git/info/sparse-checkout'
+            New-Item -ItemType Directory -Force -Path (Split-Path $sparse) | Out-Null
+            $files | Set-Content -LiteralPath $sparse -Encoding utf8
+            git -C $checkout fetch --quiet --depth=1 --filter=blob:none origin $env:CONFIG_REF
+            git -C $checkout checkout --quiet --detach FETCH_HEAD
+
+            foreach ($file in $files) {
+              New-Item -ItemType Directory -Force -Path (Split-Path $file) | Out-Null
+              Copy-Item -LiteralPath (Join-Path $checkout $file) -Destination $file
+            }
+          } finally {
+            Remove-Item Env:GIT_CONFIG_COUNT,Env:GIT_CONFIG_KEY_0,Env:GIT_CONFIG_VALUE_0 `
+              -ErrorAction SilentlyContinue
+            Remove-Item -LiteralPath $checkout -Recurse -Force -ErrorAction SilentlyContinue
+          }
+
+      - name: Resolve capacity
+        id: route
+        shell: pwsh
+        env:
+          ROUTER_TOKEN: ${{ secrets.UNIVERSE_ROUTER_TOKEN }}
+          ROUTER_PLAN: ${{ inputs.plan }}
+          ROUTER_RUN_ID: ${{ github.run_id }}
+        run: node .github/scripts/route-runners.mjs

.gitignore

@@ -1,5 +1,6 @@
 sitemap
 data
+!frontend/src/app/universe/portfolio/data/
 docker-compose.yml
 backend/mempool-config.json
 *.swp