[emranemran]

Build the wheel and source distribution in the existing Tests workflow, without publishing them. Ruff and pytest remain unchanged.

Fork PRs may run these read-only checks after maintainer approval. The repository requires workflow approval for all external contributors; fork runs receive no repository secrets. Required checks are ruff, pytest, and package directly.

No aggregate gates, merge-queue triggers, reusable-workflow additions, concurrency changes, or new YAML files. Existing release publication stays on tag/manual workflows. Managed CodeQL is restored with its original configuration and already excludes fork PRs.

Validation: actionlint and event/source/permission checks passed. GitHub CI passed on bb58cda; all final PR checks are green.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the CI gating and disabled-by-default fleet notification changes.

No open issues 🎉

What changed in this PR

Strengthens SDK CI with a failure-sensitive gate and package builds, and adds disabled-by-default notifications to the central fleet builder without authorizing deployment.

Changes:

• Adds merge-group and reusable CI support, job timeouts, package builds without publishing, and a gate requiring Ruff, pytest, and packaging to succeed.
• Adds a notification workflow that validates successful main-branch push runs before creating a repository-scoped GitHub App token.
• Documents the source contract, deployment freeze, and post-freeze activation requirements.

File	Description
.github/​workflows/​tests.yml	Adds CI triggers, concurrency controls, package builds, and the aggregate gate.
.github/​workflows/​fleet-ci-notify.yml	Adds gated, validated notifications to the central builder.
.github/​FLEET-CI.md	Documents the source contract, freeze restrictions, and activation steps.
.github/​fleet-ci.json	Defines trusted source workflow and receiver metadata.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the CI gating and disabled builder-notification changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the SDK CI workflow changes.

No open issues 🎉

_{Review effort: Balanced}

[j0sh]

Final policy: fork CI is allowed after maintainer approval, with read-only GitHub tokens and no repository secrets. The origin guards have been removed, so Ruff, pytest, and package validation actually run for approved fork contributions.

The final code change adds only the wheel/source-distribution build. Required checks are Ruff, pytest, and package directly. Aggregate gates, merge-queue preparation, reusable-workflow additions, and concurrency changes remain out. No new YAML files are added.

Managed CodeQL is restored and already excludes fork PRs. The previous custom CodeQL workflow was unnecessary and has been removed. Copilot's fork-validation concern is addressed; its gate/merge-queue suggestions refer to the superseded scope.

Workflow lint and event/source/permission checks passed. The maintainer has authorized merging after the final GitHub checks are green.

[Copilot]

🟡 Changes recommended

Repository-origin guards let fork pull requests bypass required validation, while the missing ci-gate job and merge_group trigger can block branch protection and merge-queue progress.

3 open issues

• Fork pull requests skip required validation jobs · New
• Workflow does not run for merge-queue candidates · New
• Missing required ci-gate job · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Managed CodeQL is disabled without a replacement workflow, leaving the intended security scans unconfigured.

4 open issues

• Fork pull requests skip required validation jobs
• Add the missing CodeQL workflow before disabling managed scanning · New
• Missing required ci-gate job
• Workflow does not run for merge-queue candidates

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The workflow lacks same-repository job guards for package, ruff, and pytest, allowing permitted fork PR runs to check out and execute fork code instead of skipping it before checkout.

5 open issues

• Skip fork PR code in package, ruff, and pytest jobs · New
• Fork pull requests skip required validation jobs
• Add the missing CodeQL workflow before disabling managed scanning
• Missing required ci-gate job
• Workflow does not run for merge-queue candidates

_{Review effort: Balanced}

[j0sh]

Reviewed the final 11-line package-build addition at bb58cda. It builds wheel/source distributions without publishing, preserves contents: read, and adds no secrets, environments, aggregate gates, merge-queue hooks, or new workflow files. Fork CI remains subject to the repository's all-external-contributors approval policy. Existing publication is limited to tag/manual workflows. All six GitHub checks pass. Approved under the maintainer's instruction to merge this final scope once green.