[onedr0p]

Overview

Collapses lint.yaml, tests.yaml and e2e.yaml into a single ci.yaml whose
jobs fan in to a Build Success job, so a ruleset can require branches to be up
to date before merge.

All six job bodies are unchanged. Job ids form two families (go-*, helm-*),
each name: is derived from its id, and jobs are ordered alphabetically with the
fan-in last.

Same change as home-operations/kromgo#321.

Additional information

GitHub rejects strict_required_status_checks_policy unless at least one check
is required, and the individual jobs are unsafe to require: they are skipped for
release-please PRs, and a required check that never reports blocks the PR
permanently. Build Success runs on !cancelled(), so it reports whether its
dependencies pass or skip.

The pull request trigger drops paths-ignore for the same reason. Those filters
covered **.md and .release-please-manifest.json — the release-please PR
footprint that the per-job conditions already skip.

Both e2e jobs stand up a kind cluster, so they keep their previous trigger scope
through an event guard rather than a separate file. The cache-poisoning ignore
follows them into ci.yaml; the rationale is unchanged, as the image is loaded
into kind and never pushed.

Two check names change with the id alignment: Kind end-to-end becomes Go E2E
and Helm E2E (kind) becomes Helm E2E. Only Build Success will be required,
so nothing depends on the old names.

Verified before pushing: every job body is byte-identical to origin/main,
Build Success gates all six, and actionlint, zizmor and oxfmt are clean
at the pre-change baseline.

Requirements

• I have read and agree with the contributing guidelines
• AI usage disclosure: YES — the workflow change and this description were
  written by an AI agent (Claude Code) under maintainer direction, as part of a
  wider branch-protection rollout. Per the AI Usage Policy this exceeds assistive
  use and needs maintainer review before merge.

[greptile-apps]

Greptile Summary

Consolidates the repository’s Go and Helm checks behind one required CI result.

• Replaces the separate lint, test, and E2E workflows with a six-job ci.yaml workflow.
• Adds a Build Success fan-in job and merge-group support.
• Preserves the prior push and release-please skipping behavior through job conditions.
• Moves the existing cache-poisoning suppression to the consolidated workflow.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking concern that the relocated zizmor exception now suppresses cache-poisoning diagnostics across the entire consolidated workflow.

The workflow consolidation and Build Success fan-in preserve the intended checks, but the file-wide zizmor exclusion is broader than its Helm E2E-specific justification and can conceal unrelated cache diagnostics.

Files Needing Attention: .github/zizmor.yml

T-Rex Logs

What T-Rex did

• Base capture showed release-please-only PR changes did not trigger a Build Success, confirming no build run for that pattern.
• Head capture showed CI triggered, six bodies are byte-identical by canonical bytes/hash, release-please jobs were skipped, the all-success/all-skipped fan-in completed, and a dependency failure causes fan-in to fail.
• Both the base and head runs terminated with exit code 0, indicating clean, successful completion of the steps.
• Artifacts were collected to support review, including a Python artifact and three log artifacts referenced for the base and head captures.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/ci.yaml	Consolidates six existing check jobs and adds a Build Success fan-in; no blocking behavioral defect was identified.
.github/zizmor.yml	Retargets the cache-poisoning exception to ci.yaml, making the suppression broader than its Helm E2E-specific rationale.
.github/workflows/e2e.yaml	Deletes the standalone E2E workflow after moving both job bodies into ci.yaml.
.github/workflows/lint.yaml	Deletes the standalone lint workflow after moving both job bodies into ci.yaml.
.github/workflows/tests.yaml	Deletes the standalone test workflow after moving both job bodies into ci.yaml.

_{Reviews (1): Last reviewed commit: "ci: gate pull requests on a single Build..." | Re-trigger Greptile}

[greptile-apps]

Overbroad cache-poisoning suppression

The bare ci.yaml ignore suppresses cache-poisoning diagnostics for every job in the consolidated workflow, while the comment justifies only the Helm E2E cache. This also covers the separate Go lint cache and automatically hides diagnostics for future cache-using steps added to this file.