ci: run CI only for trunk PRs and main pushes
Org-wide CI reduction: CI runs only on the trunk → main PR and on pushes to main. Feature branches merge into trunk and get no CI. Adds trunk-guard.yml to flag PRs into main that don't come from trunk. Generated mechanically (job if: gates + push branch filters); actionlint shows no new findings.
🤖 Generated with Claude Code
[!NOTE]
Medium Risk
Changes when automated validation runs for all contributions; mis-tuned gates could skip CI on the integration PR or block legitimate merges, though Trunk guard uses base-branch workflow definitions without checking out PR code.
Overview
Org-wide CI is gated behind a trunk → main merge train. Feature PRs into trunk no longer run the heavy workflow suites; full CI runs on pushes to main and on same-repo pull requests whose head is trunk and base is main. Jobs across test, rust, security, e2e, fleet, stress, install/build, format fixers, and related workflows now share that if: guard (often combined with existing change-detection conditions).
A new Trunk guard workflow (pull_request_target on main, no PR checkout) fails any PR into main that is not from this repo’s trunk branch, so direct feature→main PRs are blocked. Push triggers are tightened in places (e.g. codegen drops feature/**, fleet e2e drops feat/fleet-** on push).
AGENTS.md gains the merge-train snippet (mergeable label, base trunk, local verification expectations); prpm.lock records @agent-relay/merge-train-snippet@1.0.1.
Reviewed by Cursor Bugbot for commit 2be9ab680e6f136f214efa12511a1d247a264860. Bugbot is set up for automated code reviews on this repo. Configure here.