ci: route eligible workflows through shared reusable gate

[gblack686]

Summary

• Routes eligible Hermes Agent workflow_call checks through the gbauto shared reusable PR gate pinned to catalog commit 5bcb4f40e0dc65d5c5f838bbd16794bda185940d.
• Migrated: contributor-check.yml, docs-site-checks.yml, typecheck.yml (both TypeScript and desktop-build jobs), and uv-lockfile-check.yml.
• Preserved as local/special or deferred: ci.yml, lint.yml, tests.yml, supply-chain-audit.yml, deploy-site.yml, docker.yml, docker-lint.yml, history-check.yml, osv-scanner.yml, skills-index.yml, skills-index-freshness.yml, and upload_to_pypi.yml.

Validation receipt

• Repo identity: origin=https://github.com/gblack686/hermes-agent.git; default branch main; branch gha/t_11beed68-gblack686-hermes-agent.
• Catalog pin proof: gh api repos/gbauto/gbautomation/commits/5bcb4f40e0dc65d5c5f838bbd16794bda185940d returned the matching immutable commit.
• Before counts: 16 workflows; triggers unchanged (pull_request=1, push=4, release=2, schedule=3, workflow_call=11, workflow_dispatch=5); external reusable job calls 0.
• After counts: 16 workflows; same trigger counts and schedules; external reusable job calls 5.
• Compatibility: all edited workflows still expose on.workflow_call; ci.yml all-required-check aggregation was left unchanged.
• Preserved behavior: deploy, Docker/docker-lint, history, OSV, skills-index/freshness, PyPI release behavior, local lint/test/supply-chain scanners were not rewritten.
• Local gates: actionlint on the 4 changed workflows passed; Python YAML parse of all 16 workflows passed; git diff --check passed; high-confidence diff secret scan passed.
• Branch protection readback: gblack686/hermes-agent main returned 404 Branch not protected; no branch protection mutation was attempted.

Merge note

This is intentionally opened as a draft because the shared workflow catalog lives in gbauto/gbautomation PR NousResearch#691 and should be merged/pinned before this caller migration is marked ready.

Rollback

Revert commit 2ba49d1bb or close this PR. No branch protection settings, secrets, deploy workflows, release workflows, or schedules were mutated.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 26263190-14f3-443b-9aae-e0484489103f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gha/t_11beed68-gblack686-hermes-agent

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gblack686]

Blocked receipt for t_b73bc9df:

The caller migration PR smoke failed before jobs were created:

• PR: ci: route eligible workflows through shared reusable gate #4
• Head: 2ba49d1bb521c4366efb6f6c933a6708c73445d5
• Run: https://github.com/gblack686/hermes-agent/actions/runs/30053630194
• Result: GitHub Actions completed failure with zero jobs.

Root cause evidence:

• gbauto/gbautomation is private.
• Its reusable-workflow access level is organization (gh api repos/gbauto/gbautomation/actions/permissions/access).
• gblack686/hermes-agent is public and outside gbauto, so it cannot call gbauto/gbautomation/.github/workflows/reusable-pr-gate.yml@5bcb4f40e0dc65d5c5f838bbd16794bda185940d.

Local gates before the smoke:

• actionlint on edited workflows: pass.
• Python YAML parse of all 16 workflows: pass.
• workflow_call compatibility on edited workflows: pass.
• ci.yml all-required-check aggregation preserved unchanged.
• High-confidence diff secret scan: pass.
• Branch protection readback: gblack686/hermes-agent main is not branch-protected; no protection settings changed.

Rollback:

• Revert commit 2ba49d1bb or close PR ci: route eligible workflows through shared reusable gate #4.
• No branch protection settings, secrets, deploy/release workflows, or schedules were mutated.

Decision needed:

• Make the shared catalog callable from this public repo (public catalog repo or allowed access boundary), or exclude public/out-of-org repos from this consolidation wave.

[gblack686]

Phase 1 ops closeout receipt: not merged because PR is still DRAFT. Validator t_9d93fe2c passed with advisory that draft PRs require repo-owner undraft/approval before merge. Current readback: OPEN draft at head e62950f with no failed/pending checks. Closeout state: committed_unmerged until owner undrafts/approves.

[gblack686]

Final closeout receipt for t_b73bc9df:

• PR: ci: route eligible workflows through shared reusable gate #4
• Head: e62950f9af9b8e320b3dc0e0f6a8af55f7fe3471
• Closeout class: committed_unmerged — PR remains draft; no merge attempted.
• PR state readback: OPEN, DRAFT, MERGEABLE/CLEAN.
• Smoke run: https://github.com/gblack686/hermes-agent/actions/runs/30058882264
• Smoke result: CI completed success; no failed/pending checks in gh pr checks.

Scope:

• Migrated the public-safe eligible gates by deduplicating local workflow logic in contributor-check.yml, docs-site-checks.yml, typecheck.yml, and uv-lockfile-check.yml.
• Removed failed cross-repo private reusable calls from this public/out-of-org repo.
• Preserved ci.yml local workflow_call aggregation and deferred deploy/docker/history/OSV/skills-index/PyPI/release/supply-chain behavior.

Local validation:

• actionlint on changed workflows: pass.
• Python YAML parse of all 16 workflows: pass.
• workflow_call compatibility for changed workflows: pass.
• Before/after workflow file count: 16 -> 16.
• Before/after trigger counts unchanged: pull_request=1, push=4, release=2, schedule=3, workflow_call=11, workflow_dispatch=5.
• Before/after schedule entries unchanged: 3 -> 3.
• git diff --check origin/main...HEAD: pass.
• High-confidence diff secret scan: pass.

Known baseline note:

• Full-repo actionlint .github/workflows/*.yml still reports pre-existing shellcheck warnings in unchanged ci.yml and supply-chain-audit.yml; scoped actionlint on changed workflows passes.

Rollback:

• Revert branch commits 2ba49d1bb, 33b4174cd, and e62950f9a, or close PR ci: route eligible workflows through shared reusable gate #4.
• No branch protection, secrets, release/deploy workflows, schedules, or PyPI behavior were mutated.