[botandbang]

What and why

Every pull request push started about 53 jobs, and the org sat at the Free plan's 20-job cap for long stretches. 37% of the jobs were the changes and passed gate jobs that each of 8 workflows started on every event, even when nothing they check changed.

• Added .github/workflows/ci.yml. It has one changes job with every tool's paths filter, one job per tool that calls its workflow when its paths changed, and one "CI passed" job. "CI passed" fails when a call fails, is cancelled, or is skipped while its output was true, and on drafts.
• locallibrary-ci, web-ci, localtoolbox-ci, atstore-ci, mix-report, npm-advisories, workflow-lint and repo-checks now trigger only on workflow_call. npm-advisories and repo-checks also keep their weekly schedule. Removed from each: its changes job, its passed job, its concurrency block (a call gets the caller's group and would cancel it), and its push and pull_request triggers.
• Drafts now skip every tool's checks. Before, only locallibrary's and the website's did.
• The report and semver jobs have continue-on-error: true, so they still can't block a merge.
• Renamed the sizes and coverage artifacts to web-sizes, web-coverage and localtoolbox-sizes, since one run now holds all of them. size-report takes the artifact name as an input.
• The ruleset file requires only "CI passed".
• New policies in tools/policy/workflows.rego, each with tests: called workflows have no concurrency group and no push or pull_request trigger; report and semver jobs in called workflows have continue-on-error; a call grants every permission its workflow's jobs ask for, which actionlint doesn't check across files.
• Updated NEW_PROJECT.md, CONTRIBUTING.md, the PR template, and apps/locallibrary/CONTRIBUTING.md.

The first pull requests after this merges find no main artifact to compare coverage and sizes with, and the first push to main diffs against the commit before it.

Before merging: an admin applies the ruleset file from this branch (tools/ruleset.sh apply). The live ruleset requires the 8 old names, which this branch no longer reports. After that, open pull requests merge main to report "CI passed".

How it was tested

• tools/policy.sh: 70/70 Rego tests at full coverage, 47/47 conftest checks. Each new rule failed when its condition was broken on purpose against the real files.
• actionlint and zizmor are clean.
• That a call's result reflects a cancelled inner job, and that job-level continue-on-error keeps a failed report from failing its call, only show on GitHub.

[github-actions]

Coverage Report for apps/web

Status	Category	Percentage	Covered / Total
🟢	Lines	95.42% (🎯 93%)	7911 / 8290
🟢	Statements	94.08% (🎯 91%)	12047 / 12804
🟢	Functions	94.21% (🎯 92%)	3125 / 3317
🟢	Branches	84.71% (🎯 80%)	5619 / 6633

File Coverage

No changed files found.

Generated in workflow #4 for commit 0b5e0a3 by the Vitest Coverage Report Action

Size

Nothing from main to compare with yet. KiB are 1,024 bytes.

	This pull request
Client JavaScript	680.3 KiB
Client JavaScript, brotli	225.8 KiB
Client CSS	89.6 KiB
Client CSS, brotli	12.9 KiB

[github-actions]

Coverage Report for apps/localtoolbox

Status	Category	Percentage	Covered / Total
🟢	Lines	100% (🎯 100%)	4303 / 4303
🟢	Statements	99.64% (🎯 95%)	5862 / 5883
🟢	Functions	99.65% (🎯 95%)	1715 / 1721
🟢	Branches	97.72% (🎯 50%)	2791 / 2856

File Coverage

No changed files found.

Generated in workflow #4 for commit 0b5e0a3 by the Vitest Coverage Report Action

Size

Nothing from main to compare with yet. KiB are 1,024 bytes.

	This pull request
Packaged (localtoolbox.zip)	366.1 KiB
Unpacked (dist/)	842.8 KiB

[botandbang]

Closing and reopening so CI reruns on a merge ref that includes #348's test fix. Branch unchanged.

[github-actions]

Rust coverage

From run 4. Both are held to the thresholds in .cargo/config.toml.

Tests	Lines	Functions	Regions
All	97.39% (84407/86668)	96.51% (13501/13989)	95.66% (185835/194265)
Hegel property tests alone	95.41% (82686/86668)	94.14% (13169/13989)	93.48% (181594/194265)