[Decision · ruled C] .github/workflows/** landing: split workflow PRs, keep high-risk edits Tier H, move the rest to Tier S #31538

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Question

Every PR that touches .github/workflows/** is Tier H: the maintainer's approval is needed before landing (B2 ruling, 2026-10-13; GOVERNED_SURFACES row workflows). Is that review worth what it costs?

Measured (main, 2026-10-08 → 2026-11-08)

40 merges touched .github/workflows/**.

• 10 changed only workflow files: ci: restore the Next.js cache on every run, save it on push and schedule only #26984 ci(docs-deploy): deploy the Object UI docs site (www.objectui.org) from ui/apps/site #27005 ci: prune the build-core, typecheck and pack-smoke Turbo seeds before saving them #27067 ci(lint): describe the query-options test ratchet as one-sided #27115 ci(live-e2e-ui): run on server-only diffs too (|| core), and pin the 2-minute spec budget #27619 ci(filter): start the jobs that run setup-workspace, setup-pnpm and .nvmrc on a diff confined to them #27709 ci(ui): start the Test UI shards when a package ui consumes changes #28501 ci(fleet-write): the advisory mint comment names its four write rows and the read mint #29620 ci(dogfood): prune the per-sha Turbo seed to the run's tasks before saving it #30241 ci(scaffold-e2e): give the image run an explicit database (Refs #30120) #30714
• 30 were product or refactor PRs that also changed a workflow line, and so the whole PR waited on the maintainer: docs(skills): the i18n skill names fields.{field}.inlineTitle and a joined report's block headings #26832 ci(ui-merge): port the four objectui gates that guard published @object-ui packages into root CI #26854 ci(ui-merge): port objectui's lockfile-integrity gate into Type Check UI and retire lockfile-dedupe and the shadcn-check report #26995 ci(test-core): build declarations on one CLI slice only — pin the CLI's declaration readers into slice 1/n #27018 ci: lint.yml's scheduled run skips the battery when a green push run already covers the sha (3 of 3) #27085 ci(docker-publish): a rebuild of an older version keeps latest, X.Y and X where they are #27102 ci(fleet-patrols): prose and comments stop naming the four retired patrol workflow files #27122 ci(release),ui: the publish-check texts say what the release does today — the dead ui changeset:publish alias goes, its wiring test pins the live path #27131 refactor(app-shell): retire the designer string table and its parity gate #27136 docs(ui): generate the component reference for all 106 components from sdui.manifest.json; retire the Setup, Console and Studio pages into the metadata pages and rename the section User Interface #27179 ci(live-e2e): boot the workspace backend and run the live lane as the required Live E2E UI job #27212 docs(ui-merge): fold objectui.org into objectstack docs, K4 — retire the site, host 301s, links #27329 refactor(ui-types): one source for the filter-builder field-type list; close the three K4 review should-fixes #27400 fix(turbo): hash the ui tree root build and test inputs in the root turbo.json; guards read the live config #27571 ci: schedule the ui jobs, Build Docs and Test Core for the root inputs they read (package.json, five ui test inputs) #28089 ci(nightly-tiers): four shards — the showcase smoke alone on one, the CLI cut across the rest #28613 feat(pm/fleet-write): three security-advisory relay rows, payload read from the event file #29222 feat(console): installable desktop PWA with an offline app shell and a push-ready Service Worker #29326 chore(pm): delete changeset-deadline-census, a report-only tool nothing calls #29577 ci(ui): port the Test UI per-file timings reporter and its weekly dataset refresh #29588 chore(pm): delete the one-time stale-finding sweep tool; H63 keeps reporting #29698 feat(devx): check:package-naming — packages/services/ packages are service-NAME after their directory, and the plugin- prefix is frozen at ten (#29710) #29739 tooling: a structural gate that keeps a registered facade class delegation-only #30030 ci(dogfood): the three Dogfood Regression Gate shards run on merge_group #30639 ci(release): add the dispatch-only next snapshot lane (ADR-0125 amendment) #30799 ci(release): start the next snapshot preflight on a daily schedule, stopping at the maintainer approval (ADR-0125 amendment) #30862 ci(live-e2e): derive the Live E2E UI ceiling from its first population (40 → 45) and pin it; the saved-view-filter header names the workspace backend #30869 chore(ci): census the call sites that set the vouched-reference mark #31086 ci(required-contexts): register Dogfood Regression Gate as a required context again #31133 ci(mcp): a diff confined to packages/mcp runs the Console SKILL.md mirror pin #31138

Most of the edits are low-risk: path filters, shard counts, timeouts, budget ceilings, cache keys.

Why the review matters: workflows are the one surface that can switch off every other gate. A continue-on-error: true, a dropped required job, or an if: false turns a check off while CI still reads green. permissions:, secrets.* or a new third-party action reaches credentials. Release and deploy workflows publish.

Options

• A — Keep everything as it is.
• B — Do only C1: workflow edits ride their own PR.
• C — Do C1, C2 and C3:
  • C1. Workflow edits ride their own PR (already [Decision] Keep domain:devx and domain:server as separate lanes, or merge them? Measured load and boundary friction, 2026-11-08 #31424 rule 3: .github/workflows/** is devx by path). A product PR no longer waits on the maintainer because of one workflow line.
  • C2. These stay Tier H (the maintainer's approval):
    • release, publish and deploy workflows;
    • any added or changed permissions:, secrets.* reference or pull_request_target;
    • a new third-party uses: (one not already used in the repo);
    • a deleted job, or a change to the required-context set;
    • a new continue-on-error, or an if: that disables a job or step.
  • C3. Every other workflow edit becomes Tier S, like .claude/**:
    • a ## Contract review record with a PASS verdict for the current head, and every check green;
    • then the owning seat lands it through the queue;
    • the post-merge audit lists it, and a miss is rolled back.

Ruling

Ruled C. The stamped ruling record is the first comment below. The maintainer asked in triage's session 「现在改 workflow 文件都需要我审核，这个价值大嘛？」, and answered 「同意」 to triage's lean, C.

Execution (domain:skills, per #31424 rule 6: internal rules have their own flow)

1. scripts/pm/check-governed-merges.mjs. The workflows row gets a content-aware tier.
   • Path-based Tier H for release, publish and deploy workflow files. List them from the register; don't guess.
   • Diff-based Tier H for the C2 triggers. Otherwise Tier S.
   • Self-tests cover each trigger, plus the near-misses.
   • The queue guard (check-governed-queue-guard.mjs) and CODEOWNERS (whose mirror self-test must stay green) follow.
   • Fail closed: if the classifier can't parse the diff, the PR is Tier H.
2. AGENTS.md §14. Name the workflows row's split tier. pnpm check:pm-governed-prose must stay green.
3. pm-dispatch SKILL.md (L186/L203). Update the Tier H/S lines.
4. Do the same in cloud and objectui, where the row exists. A cross-repo card follows once the objectstack PR lands.

This PR touches AGENTS.md and .github/CODEOWNERS-routed surfaces, so it lands Tier H by the maintainer's hand.

No new gate: this relaxes an existing landing rule; it adds no check.

Generated by Claude Code