ci(pr): run a secret-free smoke on PRs, full matrix on demand

[ci-robbot]

What this PR does / why we need it:

PR CI ran the full matrix on every push and, for any PR from a fork, waited in the fork-pr-builds environment first. Almost every PR here is now opened by an agent from a fork: 92 of 135 open PRs come from ci-forks alone. When this was written, 96 PR runs were waiting for approval. Every approved push then started about 60 jobs. Agents also run QA on a real boot before merge, so the full matrix now runs on master only, and on a PR only when a maintainer asks for it.

Changes:

• pr.yaml now uses the plain pull_request trigger, with no secrets, no environment and no approval. It runs:

  • unit tests and lint
  • the kairos, kairos-init and kcrypt-challenger binary builds
  • the kairos-init image build
  • one amd64 Hadron core ISO
  • the qemu install and acceptance suites
  • the ISO size diff

  Nothing is pushed.

• The kairos-init image reaches the ISO build as an OCI layout artifact, not as a registry image:

  • _build-image-kairos-init.yaml gets an oci_artifact input.
  • reusable-factory.yaml gets oci_context_artifact and oci_context_name, which bind the layout as a named build context for the FROM ${KAIROS_INIT_IMAGE}.
  • _build-iso.yaml passes these through as kairos_init_artifact.

• _build-iso.yaml gets a security_scans switch, default true. The smoke turns it off because a fork's read-only token cannot upload SARIF. master still scans every image.

• pr-full.yaml is the old pr.yaml, now triggered only by the ci/full label (pull_request_target, types: [labeled]). There is no environment. The authorize job:

  • fails unless the person who added the label has write, maintain or admin access, because triage can add labels too
  • removes the label, so adding it again runs the matrix on a later push

  Every checkout is pinned to pull_request.head.sha from the label event, so a push after the label does not change what runs. The CodeQL rationale in the header is updated to match.

• pr-fork-checks.yaml is removed. pr.yaml now covers fork PRs without a gate.

• master.yaml is unchanged apart from comments that now point to pr-full.yaml. The Makefile workflow-lint lists include pr-full.yaml.

Before merge, a maintainer needs to:

• create the ci/full label. It does not exist yet, and I could not create it because this account has triage access only.
• decide whether to delete the fork-pr-builds environment. Nothing references it after this change.

Note on trust: any account with write access can start pr-full.yaml by adding the label, bot accounts included. Adding the label is the review of the diff.

How it was checked:

• make lint-workflows (yamllint strict and actionlint) passes.
• actionlint on reusable-factory.yaml reports the same 107 existing shellcheck findings on master and on this branch, so the change adds none.
• I checked locally that BuildKit resolves FROM ${KAIROS_INIT_IMAGE} from an oci-layout:// build context made by buildx --output type=oci from a two-platform build, with --load.
• This PR comes from a fork, so its own PR run is the end-to-end test of the new smoke path: no approval, read-only token, no registry. pr-full.yaml cannot run on this PR, because pull_request_target uses the workflow from master. It can only be tried after merge, with the label.
• Result of that run: run 37469696401 started with no approval and passed all 24 jobs in about 15 minutes. That includes the ISO built from the local kairos-init layout and the qemu install and acceptance suites. An earlier run on the older base failed install with the master: test-core install is red on both legs because a top-level bundles: entry never lands its files #5132 bundles regression, which fix(sysext): stop merging extensions over the persistent partition #5115 fixed in the meantime. The rebase onto current master made it green.

Which issue(s) this PR fixes:
Fixes #4296

AI disclosure: Claude Code wrote this change and the description, at the request of a maintainer (@mudler). No human read the code before this PR was opened.

🤖 Generated with Claude Code