Consolidate CI workflow branches

[arii]

Closes #2644
Closes #2637
Closes #2636

[github-actions]

🚀 Deployment Details (Last updated: Jun 19, 2026, 4:49 PM PST)

🚀 Pushed to gh-pages; publish in progress

• Preview URL: https://arii.github.io/tech-dancer/arii/workingbranch/
• Preview Dashboard: https://arii.github.io/tech-dancer/previews/index.html
• Commit SHA: 11fc869
• Marker File: verify here

[github-actions]

🐙 GitHub Models Code Review

Powered by GitHub Models

Reviewing: PR #2659

Model: gpt-4.1

Code Review Feedback

Review of Diff: CI Workflow Consolidation

HIGH Severity Review

1. .github/workflows/ci.yml — Job Dependency and Output Handling

Evidence:

• The new verify-changes job is introduced as a foundational gate, and downstream jobs (e.g., lint-typecheck, audit, test-build, impact-analysis) now depend on it and use if: needs.verify-changes.outputs.has_changes == 'true'.
• The reusable workflow .github/workflows/reusable-gate.yml defines an output has_changes for the job verify-changes, but the workflow-level output is defined as:

  workflow_call:
    outputs:
      has_changes:
        description: "True if changes were detected"
        value: ${{ jobs.verify-changes.outputs.has_changes }}

• However, in the calling workflow (e.g., ci.yml), jobs reference needs.verify-changes.outputs.has_changes.

Blocking Issue:

• GitHub Actions does NOT propagate outputs from reusable workflows to the calling workflow's needs context unless the reusable workflow is called via workflow_call and the output is explicitly mapped.
• In the diff, the output is mapped, but the calling workflow jobs reference needs.verify-changes.outputs.has_changes. This is only valid if the reusable workflow is called via uses: ./.github/workflows/reusable-gate.yml and the output is mapped as shown.
• However, in the calling workflow, the job name is also verify-changes, which can cause confusion and output propagation issues.
• If the output is not correctly propagated, all downstream jobs will always evaluate needs.verify-changes.outputs.has_changes as empty or undefined, causing jobs to be skipped or run incorrectly.

Concrete Contradiction:

• The output mapping in the reusable workflow is correct, but the calling workflow jobs reference needs.verify-changes.outputs.has_changes as if it is available in the needs context. If the output is not correctly propagated, this will break the workflow logic.

How to Fix:

• Ensure that the output from the reusable workflow is correctly mapped and available in the calling workflow's needs context.
• If the job name in the calling workflow is also verify-changes, it can shadow the reusable workflow's output, causing confusion.
• Best practice: Use a different job name in the calling workflow (e.g., changes-gate) and reference the output as needs.changes-gate.outputs.has_changes.

2. .github/workflows/codeql.yml — Schedule Event Logic

Evidence:

• The analyze job uses:

  if: needs.verify-changes.outputs.has_changes == 'true' || github.event_name == 'schedule'

• The verify-changes job is only triggered via workflow_call, not on schedule.

Blocking Issue:

• On scheduled runs (github.event_name == 'schedule'), the verify-changes job will NOT run, so needs.verify-changes.outputs.has_changes will be undefined.
• This can cause the analyze job to fail due to missing dependency or undefined output.

How to Fix:

• Add a conditional to only require verify-changes for non-scheduled events, or ensure verify-changes runs on schedule as well.

3. Deletion of Security and Conflict Check Workflows

Evidence:

• .github/workflows/security.yml and .github/workflows/conflict-check.yml are deleted.
• No evidence in the diff that their functionality is replaced elsewhere.

Blocking Issue:

• If these workflows provided essential security scanning or merge conflict detection, their removal without replacement is a regression.
• However, per review scope, unless the diff introduces a new untrusted input path or a regression in the stated goal, this is not blocking unless it breaks CI.

Verdict: Not blocking for this PR's stated goal, but should be tracked.

---

Summary

Blocking Issues:

• Output propagation from reusable workflow to calling workflow jobs is ambiguous and likely broken, causing downstream jobs to be skipped or run incorrectly.
• Scheduled events in codeql.yml will not have the required output, causing job failures.

---

JSON Findings

{ "findings": [ { "id": "finding-1", "file": ".github/workflows/ci.yml", "line": 41, "snippet": "needs: verify-changes\nif: needs.verify-changes.outputs.has_changes == 'true'", "issue": "Downstream jobs reference outputs from reusable workflow job 'verify-changes', but output propagation is ambiguous and likely broken. This will cause jobs to be skipped or run incorrectly.", "status": "unresolved", "fixSummary": "Ensure output from reusable workflow is correctly mapped and available in the calling workflow's needs context. Use distinct job names and reference outputs accordingly." }, { "id": "finding-2", "file": ".github/workflows/codeql.yml", "line": 29, "snippet": "if: needs.verify-changes.outputs.has_changes == 'true' || github.event_name == 'schedule'", "issue": "On scheduled runs, 'verify-changes' job does not run, so output is undefined. This can cause job failures.", "status": "unresolved", "fixSummary": "Ensure 'verify-changes' runs on schedule or adjust job dependencies and conditionals to avoid undefined outputs." } ] }

[VERDICT: FAIL]

---

Generated by github-models-code-review