Lock public CI with native disable plus invert guard

.github/workflows/preview.yml

@@ -1,3 +1,8 @@
+# Copyable Deploy Preview template. Keep this file valid YAML. Do not comment it out.
+# On SolZeroAI/platform, disable it with Actions → Deploy Preview → Disable workflow
+# (`gh workflow disable preview.yml`). Disabled state is per-repo; fork owners enable it
+# on their Actions page. The invert guard below is the belt if the public workflow is enabled.
+# Do not add secrets on SolZeroAI/platform.
 name: Deploy Preview
 
 on:
@@ -28,15 +33,15 @@ concurrency:
 jobs:
   validate:
     name: Validate
-    if: ${{ (github.event_name != 'pull_request' || github.event.action != 'closed') && github.event_name != 'workflow_dispatch' }}
+    if: ${{ github.repository != 'SolZeroAI/platform' && (github.event_name != 'pull_request' || github.event.action != 'closed') && github.event_name != 'workflow_dispatch' }}
     uses: ./.github/workflows/validate.yml
     permissions:
       contents: read
 
   deploy-preview:
     name: Deploy preview stage
     needs: validate
-    if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository) }}
+    if: ${{ github.repository != 'SolZeroAI/platform' && (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository)) }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: pre
@@ -46,7 +51,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@v7
         with:
           # Full history and tags let the deploy compute the release offset
           # label, for example v1.5.0+2-bbb222.
@@ -114,15 +119,15 @@ jobs:
       - name: Find existing comment
         if: ${{ github.event_name == 'pull_request' }}
         id: find-comment
-        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
+        uses: peter-evans/find-comment@v4
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: "github-actions[bot]"
           body-includes: "<!-- infra-preview -->"
 
       - name: Create or update PR comment
         if: ${{ github.event_name == 'pull_request' }}
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        uses: peter-evans/create-or-update-comment@v5
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}
@@ -138,7 +143,7 @@ jobs:
 
   cleanup-preview:
     name: Clean up preview stage
-    if: ${{ (github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'workflow_dispatch' && startsWith(github.event.inputs.stage, 'pre-')) }}
+    if: ${{ github.repository != 'SolZeroAI/platform' && ((github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'workflow_dispatch' && startsWith(github.event.inputs.stage, 'pre-'))) }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: pre
@@ -148,7 +153,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@v7
 
       - name: Set up Nub
         uses: nubjs/setup-nub@v0.4.0
@@ -214,15 +219,15 @@ jobs:
       - name: Find existing comment
         if: ${{ github.event_name == 'pull_request' }}
         id: find-comment
-        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
+        uses: peter-evans/find-comment@v4
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: "github-actions[bot]"
           body-includes: "<!-- infra-preview -->"
 
       - name: Update comment with cleanup status
         if: steps.find-comment.outputs.comment-id != ''
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        uses: peter-evans/create-or-update-comment@v5
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           body: |

.github/workflows/release.yml

@@ -3,7 +3,7 @@ name: Release
 on:
   workflow_run:
     workflows:
-      - Deploy Preview
+      - Validate
     types:
       - completed
     branches:
@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out validated commit
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0

.github/workflows/tegami-pr-comment.yml

@@ -22,7 +22,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out trusted release tooling
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@v7
 
       - name: Set up Nub
         uses: nubjs/setup-nub@v0.4.0
@@ -35,7 +35,7 @@ jobs:
         run: nub install --frozen-lockfile
 
       - name: Download release preview
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8
         with:
           name: tegami-pr-preview
           run-id: ${{ github.event.workflow_run.id }}

.github/workflows/tegami-pr-preview.yml

@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out pull request
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -37,7 +37,7 @@ jobs:
         run: nub run tegami pr preview --artifact tegami-pr-preview.md
 
       - name: Upload release preview
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: tegami-pr-preview
           path: tegami-pr-preview.md

.github/workflows/validate.yml

@@ -1,6 +1,12 @@
 name: Validate
 
 on:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
   workflow_call:
     inputs:
       checkout_ref:
@@ -11,6 +17,8 @@ on:
 
 permissions:
   contents: read
+  checks: write
+  pull-requests: write
 
 jobs:
   validate:
@@ -19,7 +27,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.checkout_ref || github.ref }}
 
@@ -50,8 +58,16 @@ jobs:
       - name: Check formatting
         run: nub run format
 
+      - name: Lint GitHub Actions workflows
+        uses: reviewdog/action-actionlint@v1
+        with:
+          fail_level: error
+          filter_mode: nofilter
+
       - name: Test
+        if: github.repository != 'SolZeroAI/platform'
         run: nub run test
 
       - name: Build
+        if: github.repository != 'SolZeroAI/platform'
         run: nub run build

CONTRIBUTING.md

@@ -56,6 +56,13 @@ nub run build
 run at `warn`. Lint loads the GitHub package through `tsx` because that package ships
 TypeScript source.
 
+GitHub Actions on SolZeroAI/platform runs `config:check`, `typecheck`, `lint`, `format`, and actionlint.
+Tests that need Cloudflare tokens and Deploy Preview skip on this public repository
+(`github.repository != 'SolZeroAI/platform'`). Keep `preview.yml` as valid YAML and disable it here
+with Actions → Deploy Preview → Disable workflow (`gh workflow disable preview.yml`). Disabled state
+is per-repo. Fork owners enable it on their Actions page. GitHub disables scheduled workflows on
+public forks by default. Do not comment the workflow YAML out.
+
 If a check cannot run in your environment, explain why in the pull request.
 
 ## Pull requests

README.md

@@ -207,7 +207,7 @@ When your deployment uses sandbox agents, test its selected Codex, Claude Code,
 
 For a preview deployment, use `config/pre.config.jsonc` and `config/.pre.vars`. Run `nub run infra:plan:pre`, followed by `nub run infra:deploy:pre`.
 
-GitHub Actions also deploys previews. The `Deploy Preview` workflow deploys the `pre` stage on each merge to `master`. Each pull request gets an ephemeral `pre-<number>` stage with a preview URL comment, and the workflow destroys that stage when the pull request closes. Sync the required secrets with `nub run github:sync-env-secrets`.
+Public GitHub Actions on SolZeroAI/platform run secret-less checks only (`config:check`, typecheck, lint, format, and actionlint). Keep `preview.yml` as valid YAML. On this public repository, disable it with Actions → Deploy Preview → Disable workflow (`gh workflow disable preview.yml`). Disabled state is per-repo; fork owners enable the workflow on their Actions page. GitHub disables scheduled workflows on public forks by default. Jobs that use secrets also have an invert guard (`github.repository != 'SolZeroAI/platform'`), so they skip on the public repo even if the workflow is enabled. Do not comment the YAML out. Any repository that is not SolZeroAI/platform can run those jobs without editing the file. Sync secrets only on a private deploy fork with `nub run github:sync-env-secrets`.
 
 SolZero validates the `dev`, `test`, `pre`, and `prod` profiles. Keep every profile in the repository to preserve this contract.
 

docs/releasing.md

@@ -56,9 +56,12 @@ combined version and release-note preview. A change with no observable effect ca
 ## Automated release flow
 
 1. Merge a feature pull request with its pending `.tegami/` entries.
-2. Wait for `Deploy Preview` to pass on `master`. That workflow validates the commit and deploys the
-   `pre` preview stage. The `Release` workflow then runs `nub run tegami ci` and opens or updates
-   `tegami/version-packages`.
+2. Wait for `Validate` to pass on `master`. That workflow runs the secret-less checks. The `Release`
+   workflow then runs `nub run tegami ci` and opens or updates `tegami/version-packages`. Preview
+   deploys are not required for a GitHub Release. On SolZeroAI/platform, disable `Deploy Preview`
+   with Actions → Deploy Preview → Disable workflow (`gh workflow disable preview.yml`). Keep the
+   YAML in the tree. The invert guard skips secret-using jobs on this public repository even if the
+   workflow is enabled. Fork owners enable it on their own Actions page.
 3. Review the version pull request. It updates `VERSION`, prepends `CHANGELOG.md`, consumes the
    pending entries, and writes `.tegami/publish-lock.yaml`.
 4. Merge the version pull request. After validation, the release workflow pushes the `vX.Y.Z` tag and