fix(ci): preserve PR-only caller admission in main CI

[devantler]

🤖 Generated by the Agentic Engineer

Why

Main CI fails after an otherwise green merge because two reusable workflows intentionally skip outside pull requests. The test selector incorrectly treats those skips as missing execution.

What

Restores the two callers' original admission and retains their existing event, actor and fork exclusions. Their failures still fail CI, and every selected execution must succeed. Adds a main-event regression alongside the existing pull-request case and updates the documented coverage counts.

Fixes #508
Part of #475

[devantler]

🤖 Generated by the Agentic Engineer

Validation and user evaluation for signed head cced1503031cd153a7cd83ffaeef74f4c581d76e against reviewed main 8c0214ff944f615c35b122c4c8776151dfb561ce:

The new main-event regression failed before the repair on the two selected-but-intentionally-skipped reusable callers. It now passes. The real selector and unchanged required reducer also accept the actual native needs result map from failed main run 37391448920. Ten preserved-caller failure controls and all 82 selected-execution skip controls still reject failure.

Both caller definitions exactly match their original admission, inputs, permissions and lack of prerequisites. They remain in global result aggregation. The called workflows retain their push, bot, fork and release-PR exclusions. A read-only independent audit found no other legitimate whole-caller skips among the remaining selectable reusable calls.

All six affected contract entrypoints pass, including 43 real-source credential mutation controls, selector race tests, vet and deployment-only composition. The complete 14-command maintenance baseline, shell syntax, shellcheck and diff checks pass. The required reducer and its credential-boundary digest were not changed. The commit signature was verified successfully before pushing.

Hosted and post-merge user evaluation is now complete. PR CI run 37393395416 passed at the signed reviewed head with 159 successful jobs and 76 intentional skips; current-head review 5422828570 is GREEN. PR #509 merged through the normal protected path as signed commit 726fb7edf7ecae9dff8589cbfa52d71378007597 at 2026-10-06T01:45:29Z. All five changed files match the reviewed source exactly. Main push CI 37400780658 passed at that exact merged commit with 164 successful jobs and 71 intentional skips; the unchanged required aggregate, job 112073803113, passed. The native selector log confirms 79 gated jobs plus three required native cleanup callers. Current main still equals this commit at final readback, and issue #508 is closed. This verifies clearance of the main-event regression. The full-scope main run took 26.3 minutes by run metadata timestamps; selection counts and this differently triggered run do not establish comparative narrow-change latency, runner savings or dependency-burst behavior.

[github-code-quality]

Code Coverage Overview

Languages: Go, C#

Go / code-coverage/test

The overall line coverage in commit cced150 in the codex/main-ci-caller... branch remains at 50%, unchanged from commit 8c0214f in the main branch.

C# / code-coverage/dotnet

The overall line coverage in commit cced150 in the codex/main-ci-caller... branch remains at 100%, unchanged from commit 8c0214f in the main branch.

---

_{Updated October 06, 2026 00:32 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 21 minutes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 21 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a692c14e-b180-4c92-b56b-57434057e384

📥 Commits

Reviewing files that changed from the base of the PR and between 8c0214f and cced150.

📒 Files selected for processing (5)

• .github/scripts/ci-selection/inventory.json
• .github/tests/test-ci-catalogue-scope.sh
• .github/tests/test-ci-selection.sh
• .github/workflows/ci.yaml
• AGENTS.md

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: cced1503031cd153a7cd83ffaeef74f4c581d76e

• CodeRabbit: the current PR's included-review request was refused at 2026-10-06T01:34:43Z, with a 21-minute included-quota reset for this public repository. Direct quota artifact, freshly read; the no-gate guard returned ADMIT for this exact head. Recovery is the included allowance reset, not paid overage.

• Codex: account-wide code-review usage limit at 2026-10-05T16:59:30Z, freshly verified from the direct provider artifact. Recovery is restored included review allowance; no paid credits or redundant request is used.

• Cursor Bugbot: user/team usage or spend limit at 2026-10-03T22:35:03Z, freshly verified from the direct provider artifact. Recovery requires restored allowance or the team's limit decision; no paid overage is used.

I reviewed all five changed files against 8c0214ff944f615c35b122c4c8776151dfb561ce, with a separate independent current-head review of the complete diff. Both caller declarations restore their exact original admission, inputs and permissions, remain in global result aggregation, and retain the called workflows' event, actor, fork and release exclusions. Neither the reducer nor its credential-boundary digest changes.

The main-event regression demonstrates RED then GREEN. The actual failed native main result map passes the unchanged reducer with the repaired selection. All 82 unexpected selected-execution skips and all ten preserved-caller failure controls still fail. The 79-plus-three full scope, 31-plus-three deployment floor, inventory, fixture and documentation agree. All affected contracts, 43 credential mutations, race tests, vet and the complete 14-command maintenance baseline passed. Hosted CI 37393395416 passed at this exact head with 159 successful jobs and 76 intended skips.

Fresh direct reads found no review objects, no unresolved or hidden-page threads, no Codex comment findings, and no Bugbot check-run at this head. CodeRabbit's quota shell is not a review. No correctness, security or other actionable finding remains in the complete diff.

Verdict: no P0/P1 findings