ci: eliminate duplicate validation and align Dependabot

.github/dependabot.yaml

@@ -1,9 +1,5 @@
 version: 2
 updates:
-  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  # Rust Dependencies (Cargo)
-  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
   # One non-overlapping scan covers every Cargo manifest. Keep updates
   # independent: cross-directory `group-by` PRs cannot currently refresh.
   - package-ecosystem: "cargo"
@@ -24,18 +20,8 @@ updates:
     open-pull-requests-limit: 0
     rebase-strategy: "auto"
 
-  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  # GitHub Actions (Security-Critical: SHA-Pinned)
-  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  # Dependabot understands SHA-pinned actions when formatted as:
-  #   uses: actions/checkout@abc123...  # v4.1.7
-  #
-  # It will:
-  #   1. Monitor the semantic version in the comment
-  #   2. Update the SHA when new versions release
-  #   3. Preserve the SHA-pinned format for security
-  # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
+  # Workflow pins are authoritative. Dependabot updates the immutable SHA and
+  # same-line semantic ref; dependency smoke validates both against upstream.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
@@ -46,11 +32,9 @@ updates:
     open-pull-requests-limit: 1
     rebase-strategy: "auto"
 
-    # Group all GitHub Actions updates to reduce PR noise
     groups:
       github-actions:
         patterns: ["*"]
         update-types: ["minor", "patch"]
 
-    # Note: Major version updates are NOT grouped
-    # These require manual review due to potential breaking changes
+    # Major updates stay separate for explicit review.

.github/workflows/ci.yaml

@@ -1,10 +1,8 @@
 name: CI
 
 on:
-  push:
-    branches:
-      - main
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
 
 concurrency:
@@ -22,7 +20,7 @@ permissions:
 jobs:
   rail-plan:
     name: Build Plan
-    if: ${{ github.event_name != 'pull_request' || github.actor != 'dependabot[bot]' }}
+    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.actor != 'dependabot[bot]') }}
     runs-on: ubuntu-latest
     outputs:
       build: ${{ steps.rail.outputs.build || 'true' }}
@@ -64,7 +62,7 @@ jobs:
 
   dependency-smoke:
     name: Dependency Smoke
-    if: ${{ github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.draft && github.actor == 'dependabot[bot]' }}
     uses: ./.github/workflows/_rust-job.yaml
     with:
       runner: ubuntu-latest
@@ -81,7 +79,7 @@ jobs:
   suite:
     name: CI Suite
     needs: rail-plan
-    if: ${{ github.event_name != 'pull_request' || (github.actor != 'dependabot[bot]' && (needs.rail-plan.outputs.build == 'true' || needs.rail-plan.outputs.test == 'true' || needs.rail-plan.outputs.infra == 'true')) }}
+    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.actor != 'dependabot[bot]' && (needs.rail-plan.outputs.build == 'true' || needs.rail-plan.outputs.test == 'true' || needs.rail-plan.outputs.infra == 'true')) }}
     uses: ./.github/workflows/_ci-suite.yaml
     with:
       cache_key_prefix: commit
@@ -92,7 +90,7 @@ jobs:
   complete:
     name: Complete
     needs: [rail-plan, suite, dependency-smoke]
-    if: always()
+    if: ${{ always() && (github.event_name != 'pull_request' || !github.event.pull_request.draft) }}
     runs-on: ubuntu-latest
     steps:
       - name: Assert suite passed

.github/workflows/release.yaml

@@ -61,7 +61,7 @@ jobs:
 
   publish:
     name: Publish
-    needs: [preflight, ci-gate, evidence-gate]
+    needs: [preflight, evidence-gate]
     runs-on: ubuntu-latest
     timeout-minutes: 90
     environment: crates-io
@@ -414,21 +414,3 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: scripts/ci/release-evidence-check.sh --commit "$GITHUB_SHA"
-
-  ci-gate:
-    name: CI Gate
-    runs-on: ubuntu-latest
-    timeout-minutes: 180
-    permissions:
-      actions: read
-      contents: read
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Wait for CI on release commit
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: scripts/ci/release-ci-check.sh --commit "$GITHUB_SHA" --wait

CONTRIBUTING.md

@@ -11,11 +11,11 @@ releasable history; it is not a working branch.
 | Push | Shares the branch after fast, change-aware local checks. |
 | Pull request | Declares merge intent and runs CI on the proposed change. |
 | Merge | Adds the reviewed change to protected `main`. |
-| `main` CI | Records proof for the exact commit that can become a release. |
 
-Pull-request and `main` CI may test the same source tree, but they authorize
-different events. Pull-request CI decides whether a change may merge. `main`
-CI proves the exact protected-branch commit used by the release gate.
+The protected branch requires an up-to-date `Complete` result and has no bypass
+actors, so merged commits do not repeat the pull-request suite. Release
+candidates get a separate exact-commit Weekly run with the complete CI suite,
+Cargo graph assurance, and release evidence.
 
 ## Daily branch workflow
 
@@ -85,14 +85,17 @@ just push
 current branch. No rscrypto Git-hook installation is required. Use `just
 push-full` when the change is unusually broad or release-sensitive.
 
-Open the pull request. A branch push alone does not start the normal PR suite:
+Open a draft pull request while work is still changing; expensive jobs wait
+until the pull request is ready for review. A branch push alone does not start
+the normal PR suite:
 
 ```bash
-gh pr create --base main --fill
+gh pr create --base main --fill --draft
 ```
 
-Wait for the required `Complete` check. Because the repository currently has
-one maintainer, no second approval is required; review the final diff yourself,
+Mark the pull request ready only when its head is ready for CI, then wait for
+the required `Complete` check. Because the repository currently has one
+maintainer, no second approval is required; review the final diff yourself,
 resolve any open threads, and merge in the GitHub UI.
 
 After the merge:

docs/release.md

@@ -39,8 +39,9 @@ never run `cargo publish` locally.
    candidate=$(git rev-parse HEAD)
    ```
 
-5. Wait for `main` CI to pass, then dispatch the expensive release evidence on
-   that commit. Do this before another pull request merges into `main`.
+5. Dispatch the expensive release evidence on that commit. Do this before
+   another pull request merges into `main`. Weekly reruns the complete CI suite,
+   including compiler-backed Cargo graph assurance, on the exact candidate.
 
    ```bash
    gh workflow run weekly.yaml --ref main
@@ -51,15 +52,15 @@ never run `cargo publish` locally.
    dependencies, features, build inputs, or test policy change afterward, rerun
    both workflows.
 
-6. After exact-commit CI and both evidence workflows are green, create and push
-   the signed tag:
+6. After both exact-commit evidence workflows are green, create and push the
+   signed tag:
 
    ```bash
    test "$(git rev-parse HEAD)" = "$candidate"
    just release-tag
    ```
 
-   `release-tag` rechecks live repository controls, exact-commit CI, and release
+   `release-tag` rechecks live repository controls and exact-commit release
    evidence before allowing the tag. It never publishes to crates.io locally.
 
 7. The tag starts the `Release` workflow. Approve its `crates-io` environment
@@ -74,17 +75,16 @@ never run `cargo publish` locally.
 | Gate | What it prevents |
 |---|---|
 | Release pull request | An unreviewed version or changelog mutation reaching protected `main`. |
-| `main` CI | Tagging a commit that was never proven in its final protected-branch identity. |
+| Exact-commit Weekly suite | Tagging a candidate without full tests and compiler-backed Cargo graph assurance. |
 | Weekly and RISC-V evidence | Publishing cryptographic claims without the required platform and timing evidence. |
 | Signed immutable tag | Moving a released version to different source later. |
 | Immutable, attested GitHub Release | Publishing artifacts that cannot be tied back to the tag and build. |
 | Environment approval | A tag or compromised workflow publishing to crates.io without a final human decision. |
 | Trusted Publishing | Long-lived crates.io credentials becoming a repository secret. |
 
-The repeated pull-request and `main` checks are intentional. The first answers
-"may this change merge?" The second proves "this exact protected-branch commit
-may become a release." The expensive Weekly and RISC-V evidence is not repeated
-on every pull request; it runs only for a release candidate.
+Pull-request CI answers "may this change merge?" once. The exact-commit Weekly
+suite and RISC-V evidence answer "may this protected-branch commit become a
+release?" only for a release candidate.
 
 ## One-time setup
 
@@ -139,8 +139,8 @@ release, `just release-check` validates configuration, dependency unification,
 pending intent, SemVer advice, and the generated release plan.
 
 Pull-request CI uses cargo-rail's planner to select checks from the actual
-changed surfaces. Pushes to `main`, Weekly, and release preflight run the full
-Cargo graph proof because those commits can become release inputs.
+changed surfaces. Weekly runs the full Cargo graph proof for an exact release
+candidate; release preflight consumes that result instead of recompiling it.
 
 `release-prepare` consumes the change files. After its pull request merges,
 `release-tag` deliberately does not rerun the pending-intent check. Instead, it
@@ -164,8 +164,8 @@ receive anything, the workflow:
 
 1. Verifies the annotated SSH signature, tag target, crate version, and
    changelog version.
-2. Revalidates configuration, the unified Cargo graph, dependency policy,
-   audit results, SemVer, and successful CI for the exact commit.
+2. Revalidates configuration, dependency policy, audit results, SemVer, and the
+   exact-commit Weekly Cargo graph result.
 3. Requires complete Weekly CT/RSA and RISC-V native/CT evidence from that
    exact commit and crate version.
 4. Builds the `.crate` once, reproduces the source archive from the tag, and

justfile

@@ -227,31 +227,24 @@ release-prepare:
 release-tag:
     just check-unify
     just check-repository-controls
-    scripts/ci/release-ci-check.sh --commit "$(git rev-parse HEAD)"
     scripts/ci/release-evidence-check.sh --commit "$(git rev-parse HEAD)"
     cargo rail release finalize rscrypto --yes --skip-publish
 
-# Update Root/Fuzz Manifests & GHA Pins
+# Update coordinated Cargo manifests
 update:
     @scripts/update/update-all.sh
 
 update-check:
     @scripts/update/update-all.sh --check
 
-# Refresh .github/actions-lock.yaml SHAs
-pin-actions:
-    @scripts/ci/pin-actions.sh --update-lock
-
 check-actions:
-    @scripts/ci/pin-actions.sh --verify-only
-    @scripts/ci/pin-actions-test.sh
-    @scripts/ci/upgrade-actions-test.sh
+    @scripts/ci/check-action-pins.sh
+    @scripts/ci/check-action-pins-test.sh
     @scripts/ci/dependabot-smoke-test.sh
     @scripts/ci/check-ci-ownership.sh
     @scripts/ci/check-ci-ownership-test.sh
     @scripts/ci/emit-manual-matrix-test.sh
     @scripts/ci/pre-push-test.sh
-    @scripts/ci/release-ci-check-test.sh
     @scripts/ci/release-evidence-check-test.sh
     @scripts/ci/repository-controls-evidence-test.sh
     @scripts/ci/release-identity-test.sh