[onedr0p]

Overview

Collapses the per-concern CI workflows into a single ci.yaml whose jobs fan in
to a Build Success job, so a ruleset can require branches to be up to date
before merge.

All job bodies are unchanged. Job ids form consistent families, each name: is
derived from its id, and jobs are ordered alphabetically with the fan-in last.

Same change as home-operations/kromgo#321.

Additional information

GitHub rejects strict_required_status_checks_policy unless at least one check
is required, and the individual jobs are unsafe to require: they are skipped for
release-please PRs, and a required check that never reports blocks the PR
permanently. Build Success runs on !cancelled(), so it reports whether its
dependencies pass or skip.

The pull request trigger drops paths-ignore for the same reason. Those filters
covered **.md and .release-please-manifest.json — the release-please PR
footprint that the per-job conditions already skip.

Verified before pushing: every job body is byte-identical to origin/main,
Build Success gates every job, and actionlint, zizmor and oxfmt are clean.

Note: CI is red for an unrelated, pre-existing reason

Validate fails in Setup Mise, before any workflow logic runs:

mise ERROR Failed to install npm:renovate@43.280.1: aube install failed: failed to resolve dependencies
This is a supply-chain trust check, not a version-resolution failure.

mise 2026.7.13 added a supply-chain trust check that rejects npm:renovate. This
has been failing on main since 2026-07-25T14:04, hours before this branch existed —
every recent push to main is red. Fix is either trust_policy_excludes for that tool
or pinning mise.

Worth resolving before this repo gets a required status check, or every PR here will
be blocked.

Requirements

• I have read and agree with the contributing guidelines
• AI usage disclosure: YES — the workflow change and this description were
  written by an AI agent (Claude Code) under maintainer direction, as part of a
  wider branch-protection rollout. Per the AI Usage Policy this exceeds assistive
  use and needs maintainer review before merge.

[greptile-apps]

Greptile Summary

Consolidates pull-request validation into a renamed CI workflow with a single aggregate status check.

• Renames the workflow and validation job display names.
• Adds merge-queue and manual triggers.
• Adds a Build Success fan-in job that succeeds when validation passes or is intentionally skipped.
• Adjusts concurrency grouping to isolate pull-request runs.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

The existing validation body remains intact, and the new aggregate job correctly reports success for passed or intentionally skipped dependencies while propagating validation failures.

T-Rex Logs

What T-Rex did

• The verification script ran and exited with code 0, confirming identical executable Validate bodies after the change.
• The workflow now requires the validate job and uses an if not cancelled condition, establishing the intended fan-in with needs: [validate] and if: ${{ !cancelled() }}.
• Formatting completed successfully with exit code 0 and the unavailable-tool evidence documented the local blockers encountered.
• Artifacts were prepared for review, including the Python validation script and multiple logs that support inspection of the verification results and outcomes.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/ci.yaml	Preserves the validation job while adding appropriate triggers, concurrency behavior, and a final aggregate check; no actionable defect was established.

_{Reviews (1): Last reviewed commit: "ci: gate pull requests on a single Build..." | Re-trigger Greptile}