ci(v0.4.0): protected workflow additions — protected-only PR ahead of #287 - #289
Merged
Conversation
Contributor
PR benchmarks vs base (208e7e2)Thresholds: time > +20% or allocations > +50% trigger a gate failure (label
|
…cted-only PR Extracted from vNext ahead of the v0.4.0 release (PR #287) so the protected-file guard fires on ONE small PR (admin-bypass at merge), leaving PR #287 to merge under normal ruleset enforcement with all checks green + required review-thread resolution honored. Files touched (all workflow YAML + supporting non-protected configs those workflows reference): **Protected (11 workflow files)** - aot-smoke.yaml — new (issue #180) - api-compat.yaml — new (issue #174) - cross-platform-differential.yaml — new (issue #177) - fuzz.yaml — new (issue #170) - license-audit.yaml — new (issue #185) - pr-benchmarks.yaml — new (issue #192) - pr.yaml — modified (Category!=Fuzz filter for #170) - release.yaml — modified (SLSA + manifest + template-injection fix) - reproducible-build.yaml — new (issue #183) - semgrep-sast.yaml — new (issue #172) - stryker.yaml — modified (weekly-only trigger + version pin) **Not protected (supporting files the workflows need to actually run against main; adding these to the split PR avoids first-run failures where each new workflow self-triggers on its own YAML file being added and then can't find the config it references):** - .github/api-compat/suppressions.xml — apicompat baseline (#174) - .github/license/allowed-licenses.json — license allowlist (#185) - .github/license/licenseurl-mappings.json - .github/license/packages-filter.json - tests/Wolfgang.TryPattern.AotSmoke/Program.cs — AOT smoke consumer (#180) - tests/Wolfgang.TryPattern.AotSmoke/Wolfgang.TryPattern.AotSmoke.csproj Everything is drawn verbatim from vNext HEAD; no new content introduced by this split. Reviewing this PR's diff is equivalent to reviewing just the workflow + config slice of PR #287. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Chris-Wolfgang
force-pushed
the
protected/v0.4.0-workflows
branch
from
July 17, 2026 19:02
96f67e6 to
208e7e2
Compare
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Protected-file split from the v0.4.0 release PR #287 so the guard's admin-bypass is scoped to just the workflow changes rather than the whole 43-file release diff.
Why this exists
Detect .NET Projectsin pr.yaml fails any PR that modifies.github/workflows/*.yaml.required_review_thread_resolution.Files (11)
All lifted verbatim from vNext HEAD — no new content:
Category!=Fuzztest filterExpected check state
Detect .NET Projects— protected files touched; that's the whole point. Admin-bypass at merge.detect-projects.outputs.has-projectswhich the failed guard suppresses.Follow-up after merge