From 9f5aea0b06f9ee43e2001b2af47ce344c244538c Mon Sep 17 00:00:00 2001
From: Eugene Talagrand <git@talagrand.org>
Date: Tue, 15 Sep 2026 10:36:26 -0700
Subject: [PATCH 1/2] ci: Aggregate CI results

---
 .github/workflows/benchmark.yml      |  9 +--------
 .github/workflows/ci.yml             | 15 ++++++++++++++-
 .github/workflows/cross-platform.yml |  9 +--------
 3 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index bc8a5f2..71dc664 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -1,18 +1,11 @@
 name: Benchmark
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: '1'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e54a8a7..2ebc00e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -244,12 +244,25 @@ jobs:
     - name: Run actionlint
       uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
 
+  cross-platform:
+    name: Cross Platform
+    uses: ./.github/workflows/cross-platform.yml
+    permissions:
+      contents: read
+
+  benchmark:
+    name: Benchmark
+    uses: ./.github/workflows/benchmark.yml
+    permissions:
+      contents: write
+      deployments: write
+
   ci-success:
     name: CI Success
     if: always()
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [test, fmt, docs, coverage, fuzz-build, security, minimal-versions, typos, workflow-lint]
+    needs: [test, fmt, docs, coverage, fuzz-build, security, minimal-versions, typos, workflow-lint, cross-platform, benchmark]
     steps:
     - name: Verify all required jobs succeeded
       if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
diff --git a/.github/workflows/cross-platform.yml b/.github/workflows/cross-platform.yml
index 979c180..49403a6 100644
--- a/.github/workflows/cross-platform.yml
+++ b/.github/workflows/cross-platform.yml
@@ -1,10 +1,7 @@
 name: Cross Platform
 
 on:
-  push:
-    branches: [main, feature/pipeline-test]
-  pull_request:
-    branches: [main]
+  workflow_call:
   schedule:
     # Run weekly to catch regressions
     - cron: '0 0 * * 0'
@@ -12,10 +9,6 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: '1'

From 11e23913108115287661caba1de09f3db6741dcd Mon Sep 17 00:00:00 2001
From: Eugene Talagrand <git@talagrand.org>
Date: Tue, 15 Sep 2026 10:41:00 -0700
Subject: [PATCH 2/2] ci: use oidc for codecov

---
 .github/workflows/ci.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ebc00e..c385bc6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -84,6 +84,9 @@ jobs:
     name: Code Coverage
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
     - name: Checkout code
@@ -112,13 +115,11 @@ jobs:
         retention-days: 30
 
     - name: Upload to Codecov
-      if: env.CODECOV_TOKEN != ''
       uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         files: lcov.info
         fail_ci_if_error: true
-      env:
-        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        use_oidc: true
 
   fmt:
     name: Formatting