chore: sync repo-platform build 23550f798c9c

.github/repo-platform-manifest.json

@@ -11,13 +11,13 @@
     ".github/copilot-instructions.md": {"class": "mirror", "kind": "symlink", "hash": "79909577a70fc4971a7fcfd3cbec6a1af7182ca2dadc87f2979dce5e28f93ca0"},
     ".github/dependabot.yml": {"class": "managed", "hash": "08797f7ab8d963e4b940fe249ac348e778e16591e7508cbc4e26be57738b7ce8"},
     ".github/instructions/review.instructions.md": {"class": "managed", "hash": "3390ceea1180610460f4f2cf3e40af3921f1aba288f4c11c39fbcd780dcdfdf8"},
-    ".github/repo-platform-manifest.json": {"class": "managed", "hash": null, "commit": "93cad4695e75c38b3473fa585991ce00df199d09"},
+    ".github/repo-platform-manifest.json": {"class": "managed", "hash": null, "commit": "23550f798c9c15aa044107c9be848467f223a96d"},
     ".github/settings.local.yml": {"class": "starter"},
     ".github/settings.yml": {"class": "managed", "hash": "f9d4e717e3c008d018aff7017cb3d5c3baccc21f6447710f812da7a58cdac7fb"},
     ".github/workflows/auto-assign.yml": {"class": "managed", "hash": "42534cbfecfcc71acbee7f232d2c2b6c03b523e8158fdbac354d25a27aaf6510"},
     ".github/workflows/auto-format.yml": {"class": "starter"},
     ".github/workflows/checks.yml": {"class": "starter"},
-    ".github/workflows/ci.yml": {"class": "managed", "hash": "0437a418e2a6b9177ed87e724b2f8033396ed5a6b0e2c4e8a2be5e7b8329ca3c"},
+    ".github/workflows/ci.yml": {"class": "managed", "hash": "6fbf491f535856c479162621056591f06fd326acf2aab578e210f4bc5a6d014b"},
     ".github/workflows/copilot-setup-steps.yml": {"class": "starter"},
     ".github/workflows/nightly-fuzz.yml": {"class": "starter"},
     ".github/workflows/nightly.yml": {"class": "starter"},

.github/workflows/ci.yml

@@ -14,8 +14,8 @@ on:
   pull_request:
   workflow_dispatch:
   schedule:
-    # Nightly: the scheduled run is the site leg's rebuild and link-rot check, and
-    # CodeQL keeps its weekly rescan through fleet.yml's plan output.
+    # Nightly, public repositories only: the scheduled run is the site leg's rebuild and link-rot check, and
+    # CodeQL keeps its weekly rescan through fleet.yml's plan output. A private repository's night skips every job.
     - cron: "3 4 * * *"
 
 permissions:
@@ -41,7 +41,10 @@ jobs:
   # Every platform call carries the fleet ceiling, ONE fixed block: the union of what any job of the called workflows
   # asks, each job narrowing itself to its own need. GitHub validates a called job's grant against it before the job's
   # `if` runs, so the block is unconditional and the same text on every platform call.
+  # The nightly runs in public repositories only: a private repository pays for every job that runs and has no code
+  # scanning, and a skipped job bills nothing. The gate carries the same clause, so the two skip together.
   platform:
+    if: github.event_name != 'schedule' || !github.event.repository.private
     uses: Vivswan/repo-platform/.github/workflows/fleet.yml@stable
     permissions:
       actions: read
@@ -65,9 +68,10 @@ jobs:
   # THE gate: this job's own check run (named all-green, created by the GitHub Actions app) is the ruleset's required
   # check. It passes only when each needed result is success. `checks` (the schedule run) and `release-gate` (every
   # event but the release PR and a dispatch) may skip; `platform` never may, so an all-skipped run cannot pass.
+  # A private repository's nightly is the one run with no gate: `platform` stands down there and this job with it.
   all-green:
     needs: [checks, platform, release-gate]
-    if: always()
+    if: always() && (github.event_name != 'schedule' || !github.event.repository.private)
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps: