ci(pg-erd): centralize quality on isolated self-hosted runners

[seonghobae]

Summary

Adds the fixed-consumer pg-erd-cloud quality reusable workflow to the organization control plane. The product-specific workflow retains backend/frontend gates and inherits the self-hosted-only CWL CI isolated + cwlab-ci-isolated routing contract from canonical runner-policy owner #2565. No hosted fallback, arbitrary executable input, inherited secrets, or author self-approval is added.

Current exact-head topology — 2026-10-09

• Exact head: 9c209b3bed74c5af91d00905777400134be34e9c
• Exact tree: bf1e491743c5636a29ed488a7bcf0a35f061f8ad
• First ordinary merge: b8194dfb41b045b4830b54088994e39b4f351679, parents prior ci(pg-erd): centralize quality on isolated self-hosted runners #2606 9d03f53b6deeac062b51af4f12c86c5997495091 and exact runner-policy owner ci: stage all workflows on isolated self-hosted runners #2565 a206770680895adba000d7538fc3d5a5b499149e
• Second ordinary merge: current head, parents b8194dfb41b045b4830b54088994e39b4f351679 and exact current-time fixture owner test(codeql): keep current-time fixtures fresh #2609 8ba032a3df47c8f401a7017ae84302c725c2f9c8
• Publication used an expected-head protected, non-force ref update. No rebase or Force Push occurred.
• Base is ci: stage all workflows on isolated self-hosted runners #2565 branch ci/sdp-all-self-hosted-20261003. The child comparison contains the three pg-erd-owned files plus test(codeql): keep current-time fixtures fresh #2609's one owner fixture file; it does not duplicate either prerequisite implementation.

Root cause and repair

The prior PR targeted main while claiming #2565's runner labels and custom actionlint vocabulary. That made the consumer a parallel writer of a mutable shared policy. Ordinary integration exposed seven true conflicts between protected-main runner routing and #2565. They were resolved identically to the already-published #2607 stack: #2565 remains the canonical owner of CWL CI isolated routing.

The first merged-tree repository suite then reproduced two time-dependent failures in tests/test_audit_org_codeql_coverage.py (5,512 passed, 2 failed, 10 skipped, 40 subtests). Those are the exact RED failures owned and repaired by #2609, so its exact head was integrated as a second merge parent instead of copying the fix.

Exact-tree executable evidence

• Combined pg-erd, runner-policy, queue, and CodeQL-time contracts: 346 passed normally and 346 passed with GITHUB_ACTIONS=true
• Warning-fatal complete repository suite: 5,514 passed, 10 skipped, 40 subtests
• 39/39 workflow YAML files parse successfully
• Python compileall, git diff --check, and clean worktree: GREEN
• Current exact-head CodeQL is in progress; JavaScript Coverage and Repository Metadata are queued. Pending Checks are not source failures and were not rerun or replaced.

Activation requirements / lifecycle

Draft / Proposed / merge HOLD. Draft is required because #2565 is a mutable, unready runtime prerequisite whose isolated runner group/capacity and cleanup canary remain absent.

• ci: stage all workflows on isolated self-hosted runners #2565 owns global routing, group/label policy, and isolated-capacity activation.
• test(codeql): keep current-time fixtures fresh #2609 remains an independent Ready prerequisite and requires terminal exact-head Checks plus qualifying approval before merge.
• Operator lane ContextualWisdomLab/linux-cluster-ops#326 owns disposable runner isolation/canary. Do not borrow or relabel privileged runners.
• A thin consumer caller must use a real immutable central commit SHA without secrets: inherit; required check names must be reconciled without weakening protection.
• Noema/OpenCode routes remain orchestrator/free; no provider/model/paid fallback is introduced.
• No bypass, auto-merge, source-neutral rerun, predecessor retirement, or merge is authorized by this receipt.

Provenance correction retained

Earlier offline artifact manifests contained unsupported web-retrieval claims. They remain withdrawn. Local executable results and independently reviewed source bytes are evidence; live documentation retrieval must be verified before activation.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current authority — exact stacked head

• Lifecycle: Draft / Proposed / merge HOLD. Draft is required by mutable, unready runner-policy prerequisite ci: stage all workflows on isolated self-hosted runners #2565; pending Checks or missing approval are not the reason for Draft.
• Exact head: 9c209b3bed74c5af91d00905777400134be34e9c; tree bf1e491743c5636a29ed488a7bcf0a35f061f8ad.
• Topology: ordinary merge b8194dfb41b045b4830b54088994e39b4f351679 has parents prior head 9d03f53… and ci: stage all workflows on isolated self-hosted runners #2565 exact a206770…; current head then has parents b8194df… and test(codeql): keep current-time fixtures fresh #2609 exact 8ba032a…. The ref moved with force=false and expected prior head; no rebase or Force Push.
• Base is ci: stage all workflows on isolated self-hosted runners #2565 branch ci/sdp-all-self-hosted-20261003; GitHub confirms merge-base equals exact ci: stage all workflows on isolated self-hosted runners #2565 and the child comparison is four files: three pg-erd-owned files plus test(codeql): keep current-time fixtures fresh #2609's owner fixture.
• RED on the first merged tree: the two time-dependent CodeQL fixture tests failed (5,512 passed, 2 failed). GREEN after owner integration: 346/346 combined contracts normally and under GITHUB_ACTIONS=true; full warning-fatal suite 5,514 passed, 10 skipped, 40 subtests; 39/39 workflow YAML parses; compileall and diff check GREEN.
• Exact-head CodeQL run 37895349947 is Draft-skipped. JavaScript Coverage run 37895350181 and Repository Metadata run 37895349960 are queued. They were not rerun or replaced. Reviews 0; unresolved threads 0.

This COMMENT/evidence is not approval. No bypass, auto-merge, merge, runner relabeling, access expansion, or source-neutral rerun is authorized.

[seonghobae]

Current authority — exact head 56c1435ab16fec9ef196e3bd4773845acf8f50a2

This Draft stack now consumes #2565 causal owner repair 8d4a2eb1061c060360741d4015e4350ffde6a3eb as an ordinary merge parent.

• exact tree: 18950f46bb7c6ad011dab2dd047fa7463ced29f7
• base: ci/sdp-all-self-hosted-20261003 at that exact owner head
• child delta remains bounded; the only inherited change is the fail-closed CWL law CI ↔ law-ai-agent-ci contract
• affected contracts: 59 passed normally and 59 passed with GITHUB_ACTIONS=true
• git diff --check: GREEN
• Draft reason remains the mutable owner prerequisite; queued Checks or missing approval are merge blockers only
• no force push, destructive rebase, rerun, or state toggle