[datlechin]

Summary

• ci.yml: merge_group trigger for the native merge queue. CI is the one gate and also fails a job the plan selected that did not succeed. A main push skips its suites when the merge queue already passed that exact commit and its parent was green. A release/** PR skips Linux, core and Windows, as a release/** push does.
• Detector: new suites core (a linux/-only change no longer runs core.yml), linux-deps (Cargo manifests and lock, toolchain, deny.toml, Flatpak manifests, Debian build dependencies) and packages (what the packages declare or how they build).
• ci-lint.yml replaces repo-hygiene.yml and swiftlint.yml: actionlint pinned by checksum, shellcheck over every tracked *.sh, zizmor over all of .github (moved off the macOS runner and out of build-linux.yml).
• Changelog check: scripts/ci/check-changelog-edits.sh, run by Lint (current title, merge groups included) and by PR title (a title edit starts no CI run; release/* still requires it). PR title is advisory on main.
• build-linux.yml: called by CI with the baseline (fast job, default server releases, x86_64 Flatpak Devel with its tests, translations, supply chain); no job waits for the fast job. dependencies adds the minimum Rust version, aarch64 Flatpak and the advisory database. extended (nightly) adds every other server release in integration-releases, paths with spaces, both Flatpak architectures and advisories. The em dash check warns. Its own cron is gone.
• linux-packages.yml: no pull_request trigger or cron. CI calls it on the packages suite (x86_64); the nightly calls it with the Flatpak repository, arm64 on Sundays. ci(linux): pass the Flatpak and package builds and test PostgreSQL 15 and Fedora 45 #4047's disk and Mock steps, feat(linux): beta channels, a signed Flatpak repository and packages on every GitHub release #4046's matrix and channel flow and feat(linux): TablePro accounts and usage data #4053's PostHog key are unchanged; release-linux.yml calls it as before.
• core.yml: the Swift bindings build in the macOS core job (one macOS runner, not two); the Arm64 OpenSSH tunnel tests run nightly.
• windows.yml: no zizmor step. TablePro.Interop.csproj runs csbindgen for the core's own target, profile and flags on a host build, so the bindings check stops compiling the core again.
• nightly.yml: the one schedule (19:17 UTC, a second cron line for Sundays). Every suite in full on main, build-linux.yml extended, then the packages, core's Arm64 tunnel tests, and the unsigned Release Build job that replaces release-build.yml.
• Caches: rust-cache saves from main only in build-linux.yml, core.yml and windows.yml; the macOS and the new iOS SPM caches save on push and nightly.
• Hardening for zizmor over every file: persist-credentials: false on every checkout that never pushes (release.yml, macOS and iOS tests); the gh-pages writers keep theirs with an annotated ignore; Dependabot gets a 7-day cooldown.
• Docs: .claude/rules/ci.md, changelog.md, plugin-system.md, the release skill, windows/AGENTS.md, apple/CONTRIBUTING.md, linux/AGENTS.md, linux/docs/testing.md, linux/po/README.md.
• Tests changed on purpose: scripts/ci/test_detect_changed_paths.py (core split, new suites, renamed workflows). New: scripts/ci/test_check_changelog_edits.py.

Measured

• Before (2026-10-29 to 11-05): PR CI success median 106 min elapsed; PR package runs 205 min.
• Actions cache: 10.6 GB used of the 10 GB limit, every entry scoped to a pull request; a main push's Cargo restore printed "No cache found".
• Windows (macOS): 32 to 40 min, now 18; its bindings step 1012 s, now 42 s.
• Core (Windows Arm64): 39 to 54 min, now 27; Start Windows' OpenSSH Server took 829 to 1239 s and runs nightly.
• Core macOS plus Swift bindings: one 28 min macOS job instead of 24 and 9 min on two.

Where a larger runner would help

• macOS Tests: Build for testing takes 34 to 37 of its 68 to 77 minutes on the 3-core xcode-27 image.
• Release App: 199 minutes of build, sign and notarize for v0.86.0-beta.1.
• Linux Fast checks with a cold cache: 66 minutes, 40 of them Clippy and the Meson build.
• Core on Windows: cargo check alone takes 21 to 26 minutes.

Test plan

• actionlint 1.7.12 and zizmor offline at medium over every workflow and action, shellcheck on the changed scripts, scripts/ci and linux/build-aux/tests/test_regression_names.py unit tests: clean locally.
• Run 42004450070 at 2dbe36d: Lint (zizmor 1.30.1), macOS, iOS, core and Windows passed.

Ruleset change after merge

• New ruleset on ~DEFAULT_BRANCH: required check CI (GitHub Actions, 15368), strict off; merge queue SQUASH, ALLGREEN, build 1, merge 1 to 1, wait 0, check timeout 360 min; admin bypass in pull_request mode.
• Ruleset 25435242: include only refs/heads/release/* (exclude release/0.82 kept), checks CI and PR title unchanged.