From 81fe0fea09f338d5bc43ffa9089c05d51ff6915d Mon Sep 17 00:00:00 2001
From: Kyle Tse <hi@kylet.se>
Date: Fri, 2 Oct 2026 23:28:35 +0000
Subject: [PATCH 1/2] ci: one CI workflow with workflow lint and a ci-ok
 aggregate for the required check

---
 .github/actionlint.yaml                       | 12 +++++
 .github/workflows/ci.yml                      | 51 +++++++++++++++++++
 .github/workflows/content-checks.yml          |  3 +-
 .github/workflows/ftl-daily-budget-action.yml |  3 +-
 .github/workflows/game-standard-action.yml    |  3 +-
 5 files changed, 66 insertions(+), 6 deletions(-)
 create mode 100644 .github/actionlint.yaml
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..713c416
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,12 @@
+# Runner labels the Cubeage workflows and the reusable workflows they call
+# request; actionlint rejects any label not listed here.
+self-hosted-runner:
+  labels:
+    - standard
+    - sylphx
+    - sylphx-linux-standard
+    - sylphx-linux-control
+    - sylphx-linux-xlarge
+    - sylphx-linux-standard-merge
+    - sylphx-linux-xlarge-merge
+    - sylphx-registry-publisher
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..2f224e4
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,51 @@
+name: CI
+
+# One gate for this repository: every check runs under this workflow and the
+# `ci-ok` aggregate is the required status check (ruleset sylphx-merge-queue).
+# content-checks, game-standard-action and ftl-daily-budget-action are called
+# from here (workflow_call only), so their jobs count toward `ci-ok`.
+on:
+  pull_request:
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  content-checks:
+    uses: ./.github/workflows/content-checks.yml
+
+  game-standard-action:
+    uses: ./.github/workflows/game-standard-action.yml
+
+  ftl-daily-budget-action:
+    uses: ./.github/workflows/ftl-daily-budget-action.yml
+
+  # Parse and lint every workflow with the pinned actionlint 1.7.12 and this
+  # repository's .github/actionlint.yaml (runner labels).
+  workflow-lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: SylphxAI/.github/.github/actions/workflow-lint@a0d0ef46284e23283417d3d34063ea38882a0333
+        with:
+          args: |
+            -config-file
+            .github/actionlint.yaml
+
+  # The required check. Skipped jobs pass; failed or cancelled ones fail. It
+  # runs on the reserved control pool so a verdict never waits for a seat.
+  ci-ok:
+    if: always()
+    needs: [content-checks, game-standard-action, ftl-daily-budget-action, workflow-lint]
+    runs-on: sylphx-linux-control
+    timeout-minutes: 5
+    steps:
+      - uses: SylphxAI/.github/.github/actions/needs-pass@a0d0ef46284e23283417d3d34063ea38882a0333
+        with:
+          needs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/content-checks.yml b/.github/workflows/content-checks.yml
index bc60153..d58a3fb 100644
--- a/.github/workflows/content-checks.yml
+++ b/.github/workflows/content-checks.yml
@@ -6,8 +6,7 @@ name: content-checks
 # - zh-hant (owner standards/experience.md): advisory until 2026-10-02. On that
 #   date drop its continue-on-error and make the "zh-hant" check required.
 on:
-  pull_request:
-  merge_group:
+  workflow_call:
 
 permissions:
   contents: read
diff --git a/.github/workflows/ftl-daily-budget-action.yml b/.github/workflows/ftl-daily-budget-action.yml
index 5455a4f..58862a6 100644
--- a/.github/workflows/ftl-daily-budget-action.yml
+++ b/.github/workflows/ftl-daily-budget-action.yml
@@ -5,8 +5,7 @@ name: ftl-daily-budget-action
 # runs the same way); a title repository runs the action on
 # sylphx-linux-standard.
 on:
-  pull_request:
-  merge_group:
+  workflow_call:
 
 permissions:
   contents: read
diff --git a/.github/workflows/game-standard-action.yml b/.github/workflows/game-standard-action.yml
index 8c20b11..7b71e76 100644
--- a/.github/workflows/game-standard-action.yml
+++ b/.github/workflows/game-standard-action.yml
@@ -4,8 +4,7 @@ name: game-standard-action
 # free standard hosted runners are allowed here (content-checks.yml runs the
 # same way); a title repository runs the action on sylphx-linux-standard.
 on:
-  pull_request:
-  merge_group:
+  workflow_call:
 
 permissions:
   contents: read

From 5b10c4e9448b3e94e9ac9b1d44d5e228079c59c5 Mon Sep 17 00:00:00 2001
From: Kyle Tse <hi@kylet.se>
Date: Fri, 2 Oct 2026 23:37:20 +0000
Subject: [PATCH 2/2] ci: ci-ok on the hosted runner, a public repository
 cannot use the control pool

---
 .github/workflows/ci.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f224e4..625c3af 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,12 +38,14 @@ jobs:
             -config-file
             .github/actionlint.yaml
 
-  # The required check. Skipped jobs pass; failed or cancelled ones fail. It
-  # runs on the reserved control pool so a verdict never waits for a seat.
+  # The required check. Skipped jobs pass; failed or cancelled ones fail. This
+  # repository is public, so its runner groups do not serve it (public
+  # repositories are not allowed on them) and every job here uses GitHub's free
+  # hosted runner; sylphx-linux-control would queue forever.
   ci-ok:
     if: always()
     needs: [content-checks, game-standard-action, ftl-daily-budget-action, workflow-lint]
-    runs-on: sylphx-linux-control
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - uses: SylphxAI/.github/.github/actions/needs-pass@a0d0ef46284e23283417d3d34063ea38882a0333