Scope CI by visibility: private repositories run on pull requests and dispatch only

[kalidke]

This PR implements admiral decision 0025 as Keith revised it. Actions minutes are free on public repositories, so they keep push and scheduled CI and the warm cache. Private repositories test on pull requests and by hand (workflow_dispatch) only.

The merge is a squash. The earlier commits on this branch removed the caller's triggers outright; 7942c1c and a5fabb7 replace them, so the net diff against main is what is described here.

Change

• templates/CI.yml: unchanged. It is byte-identical to main, so no package copy has to change. GaussMLE's copy, from its commit c8d4a77, differs and needs reverting to match.

• julia-ci.yml, which events may run: the job conditions list what may run instead of what to skip. A job may run on:

  • pull_request (not a draft);
  • workflow_dispatch;
  • any event of a public repository, read from github.event.repository.private;
  • a scheduled run that the visibility job found public.

  A scheduled event carries no repository object, so the visibility job looks the repository up with gh api, on scheduled runs only. An event a private caller adds later, such as merge_group, release or repository_dispatch, therefore runs nothing. No condition tests private == false, because null == false is true.

• julia-ci.yml, per-job rules:

  • A private repository tests Julia 1 only; its floor is in the local record.
  • downgrade and pre run in public repositories only. Downgrade's gate is the public test alone.
  • Public repositories keep the min/1 matrix and run on every event, as before.

• Caches:

  • A public repository saves from its default branch only, including a push to main.
  • A private repository has no push runs, so every one of its runs saves: JULIA_CACHE_SAVE gains || github.event.repository.private.
  • The Runic job gains actions: write and drops delete-old-caches: 'false'. After a save off the default branch, julia-actions/cache deletes the caches that save replaces, and that needs the permission.

• Superseded pull-request runs: the template's concurrency (cancel-in-progress on pull_request) already cancels them. It is unchanged.

• selftest.yml: keeps push (this repository is public). It gains the template's pull_request types, so a draft marked ready gets a real run. It also gains workflow_dispatch.

• README.md: states the private-repository rule, how each kind of repository's cache is seeded, and that GitHub drops a cache unused for 7 days. It also corrects the timeout to 60 minutes.

Test

The Self-test is green on a5fabb7 for both push (run 36450435050) and pull_request (run 36450441599).

• Public path. Core - Julia min and Core - Julia 1, QA, Core - lowest compat and Runic ran and passed. Visibility and pre were skipped.
• Private and scheduled paths. These were proven on a throwaway branch, diag/visibility, with the self-test. The branch and its caches are now deleted.

Simulation	Event	Result
github.event.repository.private set to true	push	every job skipped (run 36450441614)
same	workflow_dispatch	Core - Julia 1, QA and Runic only; downgrade and pre skipped; all three saved a cache (run 36450449804)
same, second dispatch	workflow_dispatch	each job saved a cache and deleted the one it replaced, Runic included (run 36450587759)
a scheduled event without a repository object: the repository field renamed, dispatch removed from the list, 'schedule' read as 'workflow_dispatch'	dispatch	Visibility found the repository public; every job ran, including downgrade and pre (run 36450737114)
same, with the lookup reporting private	dispatch	only Visibility ran; every other job skipped (run 36451009448)

Notes for review

• Required checks. A private repository whose branch protection requires the Core - Julia min check would wait on it forever. No lab repository is known to require it.
• Private cache budget. A private repository's pull-request caches share its 10 GB budget with the default branch's cache. Each job keeps one cache per ref, and GitHub drops caches unused for 7 days.
• v2. The change is backward-compatible for callers: nothing that passed can turn red, and no input changed. The release is the merge plus moving v2.

🤖 Generated with Claude Code