[PetrefiedThunder]

Implements GitHub Ops baseline (/workspace/github-ops/baseline.md) ranked move 2 (stop double runs: push on main, pull_request for PRs into main).

Change

copy-gate.yml, copy-lint.yml, factory-local-ci.yml: add branches: [main] under pull_request (existing path filters unchanged). These were the only path-filtered PR workflows without a base-branch filter, so stacked PRs (base = another feature branch) ran them twice: once on the stacked PR and again when retargeted to main.

Already done on main (no change)

• backend-ci, frontend-ci, sdk-ci, infra-k8s-ci, bundle-analysis, openapi-public-spec, proxy-smoke: push restricted to main/develop and pull_request to main, with path filters.
• sync-main-into-prs: already alert-only and already skips unchanged alerts.
• Path filters on the PR guard workflows: deliberately not added (they must report on every PR); see ci: consolidate PR guard workflows into one PR Guards workflow #3637.
• security.yml and supply-chain.yml keep running on all PR bases on purpose (secrets and dependency scans on stacked PRs).

Verify

• actionlint on the three files passes; pre-commit passes.
• None of these produce required checks (CI Status Gate, PR Gate: Backend, PR Gate: Frontend, PR Gate: Workflow Contract).
• After merge: a PR whose base is not main and that touches frontend/** no longer starts Copy gate or the Copy rules report.

---

Note

Low Risk
Workflow trigger-only change with no application or security logic; slightly narrows when optional CI runs on stacked PRs.

Overview
Aligns Copy gate, Copy rules report, and factory-local CI with the repo’s GitHub Ops baseline so path-filtered workflows only run on PRs into main, matching workflows like backend-ci and frontend-ci.

Each of the three workflow files adds branches: [main] under pull_request; existing path filters and push triggers on main are unchanged. Stacked PRs whose base is another feature branch will no longer fire these jobs until the PR targets main, avoiding duplicate runs when the same changes are exercised twice.

^{Reviewed by Cursor Bugbot for commit d0f95b6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
regengine	Ready	Preview	Oct 26, 2026 10:29am UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T10:28:47.835147Z	d0f95b6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: regengine/RegEngine
• Branch: gemini/ops-pr-triggers
• File: .coderabbit.yaml
• Commit: d0f95b6
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a5b9d720-cb38-49bc-83f0-51d38a9d69bc

Commits

Reviewing files that changed from the base of the PR and between 4e2d32c and d0f95b6.

Files selected for processing: 3

• .github/workflows/copy-gate.yml
• .github/workflows/copy-lint.yml
• .github/workflows/factory-local-ci.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

Walkthrough

The copy-gate, copy-lint, and factory-local-ci workflows now limit pull-request runs to the main branch. Existing path filters remain unchanged.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: Minimal · up to d0f95

The workflows will run only for pull requests targeting main as intended, with no identified merge-blocking risk.

Architecture risk: Low · up to d0f95

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/copy-gate.yml: The pull_request trigger now filters by the main branch; its existing path filters remain unchanged.
• observed — Modified behavior in .github/workflows/copy-lint.yml: The pull_request trigger now filters target branches to main; previously, it had no branch filter.
• observed — Modified behavior in .github/workflows/factory-local-ci.yml: Pull-request events now trigger this workflow only for the main branch.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: limiting the Copy and factory-local CI pull request triggers to the main branch.
Description check		The description clearly explains the change, its purpose, affected workflows, validation results, and expected behavior after merge. It does not use the repository template headings or complete the Ty…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly explains the change, its purpose, affected workflows, validation results, and expected behavior after merge. It does not use the repository template headings or complete the Type of Change, Checklist, and Related Issues sections, but it provides the required implementation and verification context.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[PetrefiedThunder]

REVIEW: PASS pi d0f95b6

1. Required checks: branch protection on main requires only CI Status Gate, PR Gate: Backend, PR Gate: Frontend and PR Gate: Workflow Contract. Copy gate, Copy rules report and factory-local CI are not required, and no other workflow depends on them (the copy-lint-tools-grade-verdicts job lives in pr-gate.yml and is unaffected). Restricting them to PRs into main cannot leave a required check missing. The one open PR with a non-main base, #3612 into kimi/edi-preserve-event-time, will simply skip these advisory checks, and they run again when that work targets main.
2. #3637: it adds a concurrency block below the paths list in copy-gate.yml, while this PR adds a branches line above paths. The hunks don't overlap and the two changes are compatible, whichever merges first.
3. YAML: all three files parse, and actionlint passes on copy-gate.yml, copy-lint.yml and factory-local-ci.yml at this head.

[github-actions]

PR Blocker Checklist

Head SHA: d0f95b6573131455fd908eb9f1197f627e6b9b9f

Status: Ready

• All review threads resolved
• No reviews requesting changes
• No blocked review engines