[onedr0p]

Overview

Two changes:

1. lint.yaml, tests.yaml, coverage.yaml and e2e.yaml collapse into one
   ci.yaml whose jobs fan in to a Build Success job, so a ruleset can require
   branches to be up to date before merge. All nine job bodies are unchanged.
2. docs.yaml becomes a reusable workflow behind workflow_call, called by
   ci.yaml with deploy: false and by a new pages.yaml with deploy: true.

Same shape as home-operations/miroir#354 and home-operations/tuppr#428.

Additional information

GitHub rejects strict_required_status_checks_policy unless at least one check
is required, and the individual jobs are unsafe to require: they are skipped for
release-please PRs, and a required check that never reports blocks the PR
permanently. Build Success runs on !cancelled(), so it reports whether its
dependencies pass or skip.

docs

pages.yaml keeps both the concurrency: pages group and the plugins/**
paths-ignore, so Pages deploys stay serialized and the krew manifest push from
a release still does not retrigger a docs rebuild. Losing either would have been
easy to miss when the trigger moved out of docs.yaml.

docs.yaml declares no workflow-level permissions. They would apply to
publish as well and cap it at contents: read, starving actions/deploy-pages
of pages: write and id-token: write. publish inherits the caller's grant;
build keeps its own reduction, which is valid from either caller.

Renames

e2e.yaml's build job becomes e2e-image, since build also names jobs in
docs.yaml and plugin-binaries.yaml. Its needs: reference was updated with
it. The name keeps a per-image suffix (E2E Image (${{ matrix.image }})) so each
matrix leg still reports a distinct check — the original put the expression
mid-string (Build ${{ matrix.image }} image), which would otherwise have
collapsed every leg onto one check name.

helm-test becomes helm-unittest, matching the other repos in the org.

goreleaser-check.yaml is deliberately left alone

Its pull request trigger is scoped to .goreleaser.yaml, Cargo.* and the mise
pins. Folding it into ci.yaml would either run the plugin-binaries matrix and
a Pro snapshot render on every pull request, or need a changed-files gate to
preserve that scoping. Its Binaries and Snapshot checks therefore stay outside
the fan-in and will not be covered by the required check — worth a decision
separately.

Verified

• Every job body byte-identical to origin/main
• All needs resolve; Build Success gates all ten jobs
• actionlint, zizmor, oxfmt clean

Not verified: the deploy path. deploy: true only runs on a push to main.

Requirements

• I have read and agree with the contributing guidelines
• AI usage disclosure: YES — the workflow changes and this description were
  written by an AI agent (Claude Code) under maintainer direction, as part of a
  wider branch-protection rollout. Per the AI Usage Policy this exceeds assistive
  use and needs maintainer review before merge.

[greptile-apps]

Greptile Summary

Consolidates pull-request checks behind a single required status and shares the documentation build between CI and Pages deployment.

• Replaces separate lint, test, coverage, and end-to-end workflows with a unified CI workflow and Build Success fan-in job.
• Converts the documentation workflow into a reusable workflow called by CI without deployment and by Pages with deployment enabled.
• Updates the end-to-end shard coverage test to read the renamed workflow.

Confidence Score: 5/5

The PR appears safe to merge because no eligible blocking failure remains.

No blocking failure remains.

T-Rex Logs

What T-Rex did

• The negative-control guard detected an omitted target, as shown by the e2e-shard-guard-01-before.log.
• The head checkout passes, confirmed by the complete command output in the e2e-shard-guard-02-after.log.
• The coverage summary confirms 38/38 exact coverage across targets and binaries.
• The three evidence artifacts were prepared and linked for review to support this validation.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/ci.yaml	Consolidates the existing CI jobs, adds merge-group coverage, and introduces the aggregate Build Success check.
.github/workflows/docs.yaml	Converts documentation building and optional publication into a reusable workflow controlled by a required deploy input.
.github/workflows/pages.yaml	Adds the main-branch and manual entry point for serialized GitHub Pages deployment.
crates/e2e/src/lib.rs	Updates the shard coverage test and its diagnostics to reference the consolidated CI workflow.

_{Reviews (2): Last reviewed commit: "ci: gate pull requests on Build Success ..." | Re-trigger Greptile}

[onedr0p]

Found and fixed a break in this PR that CI would have caught but review might not have.

crates/e2e/src/lib.rs reads the workflow at test time to assert every e2e test
binary is named in some shard's bins:. Deleting e2e.yaml made it panic:

thread 'shard_coverage::every_e2e_test_binary_runs_in_some_ci_shard' panicked at crates/e2e/src/lib.rs:286:33:
read .github/workflows/e2e.yaml: No such file or directory (os error 2)

It now reads ci.yaml, and the failure message points at the e2e job there.
All 17 bins: entries moved across unchanged, so the assertion itself is
unaffected — cargo test -p kopiur-e2e --lib is 14 passed, 0 failed.

Worth noting this class of breakage is invisible to workflow linting: the file is
referenced from Rust, not from YAML. I audited the other 16 repos in this rollout
for source or config referencing a deleted workflow — kopiur was the only one with
a code reference, but five have README badges pointing at deleted workflow files,
which I am fixing separately.