[emranemran]

Skip fork PRs before checkout in Go tests, reusable packaging, and Docker publishing. No new workflow files are added.

Restore the original Build workflow and remove aggregate gates, merge queue triggers, and rollout-only test timeouts. Existing main, same-repository PR image publishing, and release controls remain intact.

External contributions must be reviewed and validated on a repository branch before merging. Job guards are supplemented by the live requirement for approval of all external contributors. CodeQL uses the original GitHub-managed default setup, which already excludes fork PRs. No custom CodeQL workflow is needed or added. The required CI check is test.

Validation: actionlint passed with allowances for existing runner labels and concurrency queue syntax; existing offline release-control tests passed; 51 workflow/event/source combinations passed without executing fork code. See Checks for the current GitHub test, package, and CodeQL results.

[Copilot]

🟡 Changes recommended

Notifications to the private receiver fail because gh workflow run reads workflow contents before dispatching, which the Actions-only App token cannot access; use the workflow-dispatch REST endpoint directly.

1 open issue

• Dispatch workflows without requiring Contents permission · New

What changed in this PR

Adds an aggregate check to the reusable Go CI workflow and a gated notification path to the central fleet builder, while preserving the existing Build workflow and deployment freeze.

Changes:

• Adds merge-group coverage, a test timeout, and a failure-sensitive ci-gate.
• Adds a disabled-by-default notification workflow that validates successful Build runs before creating a scoped App token.
• Documents the source contract, freeze restrictions, and post-freeze activation steps.

File	Description
.github/​workflows/​fleet-ci-notify.yml	Validates source runs and conditionally notifies the central builder.
.github/​workflows/​ci.yml	Adds merge-group support, a test timeout, and an aggregate CI gate.
.github/​FLEET-CI.md	Documents the source contract, deployment freeze, and activation procedure.
.github/​fleet-ci.json	Defines trusted source and receiver metadata.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the CI and merge-queue workflow changes.

1 open issue

• Dispatch workflows without requiring Contents permission

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the CI gate, merge-queue, and builder-notification changes.

1 open issue

• Dispatch workflows without requiring Contents permission

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The CI workflow changes have no active review issues.

No open issues 🎉

1 resolved since last review

• Dispatch workflows without requiring Contents permission

_{Review effort: Balanced}

[j0sh]

Thanks for the CI work here. I've narrowed this PR to the maintainer's preference to avoid executing fork-provided code and to keep changes tied to current needs.

• Removed ci-gate and package-gate. The Go test job is already required, and the extra jobs did not add tests. The live ruleset now requires test without the removed gate names.
• Restored the original fork packaging exclusion and Build behavior. Added source checks before checkout in the existing Go test and reusable package/publisher jobs, so those entry points also skip fork PRs.
• Removed the custom CodeQL workflow and restored the original managed setup. Correction to the earlier explanation: GitHub default setup already excludes fork PRs. The claimed independent fork autobuild path was incorrect, so no custom CodeQL YAML is needed.
• Removed merge queue preparation and the added timeout on the existing test job. There is no configured merge queue or demonstrated need for that additional orchestration.

All external contributors now require workflow approval. Because fork authors can propose workflow edits, that repository-level policy remains necessary alongside job guards. Please review outside contributions and validate them on a repository branch before merging; GitHub can accept skipped required jobs.

The PR remains open because the existing fork execution restrictions are substantive. This is a conservative execution policy, without claiming the previous configuration exposed publishing credentials.

Workflow lint, existing offline release-control tests, and 51 event/source checks passed. GitHub validation is available in Checks. No deployment or merge was performed.

The broader fork-CI policy is being reassessed. Copilot correctly notes that skipped jobs do not prove a contribution was tested; its fork-validation concern has not been rejected.

[Copilot]

🟡 Changes recommended

Fork PRs bypass Go and package validation, and merge-queue candidates cannot report the promised package-gate status, leaving critical CI coverage gaps.

2 open issues

• Fork PRs skip the required Go test job · New
• Package validation and merge-queue gate are missing · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The replacement CodeQL workflow is missing, leaving main, trusted PRs, scheduled runs, and manual runs without analysis when managed default setup is disabled.

2 open issues

• Package validation and merge-queue gate are missing
• Add a guarded CodeQL workflow before disabling default setup · New

1 resolved since last review

• Fork PRs skip the required Go test job

_{Review effort: Balanced}

[j0sh]

Closing without merge under the final approved policy: fork CI may run after maintainer approval with read-only tokens and no secrets. The only remaining changes in this PR are fork-origin guards, so there is no substantive change left to take.

Existing read-only Go CI remains in place. External-contributor workflow approval is required, the required check is test directly, and managed CodeQL is restored. The fleet integration, aggregate gates, merge-queue preparation, and custom CodeQL YAML are not being introduced. Existing packaging eligibility and publishing restrictions remain in place.