ci: gate release PRs behind one Release gate context

.github/workflows/android.yml

@@ -24,34 +24,6 @@ permissions:
 
 on:
   workflow_call:
-  pull_request:
-    # Main PRs skip it; nightly.yml runs it on main. `edited` catches a main PR
-    # retargeted to release. `closed` is here only so merging/closing a PR
-    # cancels its in-flight run via the concurrency group below; the job itself
-    # is skipped on close.
-    branches: [release]
-    types: [opened, synchronize, reopened, edited, closed]
-    paths:
-      - "rs/moq-video/**"
-      - "rs/moq-ffi/**"
-      - "rs/moq-tokio/**"
-      - "rs/moq-mux/**"
-      - "rs/moq-net/**"
-      - "rs/moq-nvenc/**"
-      - "rs/moq-loc/**"
-      - "rs/moq-msf/**"
-      - "rs/moq-json/**"
-      - "rs/moq-flate/**"
-      - "rs/moq-pattern/**"
-      - "rs/hang/**"
-      - "rs/kio/**"
-      - "rs/justfile"
-      - "justfile"
-      - ".cargo/config.toml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "rust-toolchain.toml"
-      - ".github/workflows/android.yml"
 
 concurrency:
   group: android-${{ github.ref }}
@@ -63,7 +35,6 @@ env:
 jobs:
   android:
     name: Android
-    if: github.event.action != 'closed'
     # x86_64 rather than the arm runners check.yml uses: GitHub documents the
     # Android SDK and NDK as preinstalled on this image.
     runs-on: ubuntu-24.04

.github/workflows/audio-quality.yml

@@ -7,22 +7,6 @@ name: Audio quality
 # in nightly.yml.
 on:
   workflow_call:
-  pull_request:
-    # Main PRs skip it; nightly.yml runs it on main. `edited` catches a main PR
-    # retargeted to release.
-    branches: [release]
-    types: [opened, synchronize, reopened, edited]
-    paths:
-      - "js/watch/**"
-      # The container consumer decides what a replay delivers, waits for, and skips, on the
-      # groups, tracks, and signals underneath it.
-      - "js/hang/**"
-      - "js/net/**"
-      - "js/signals/**"
-      - "test/audio-quality/**"
-      - "test/lib/**"
-      - "test/justfile"
-      - ".github/workflows/audio-quality.yml"
 
 concurrency:
   group: audio-quality-${{ github.ref }}

.github/workflows/cpp.yml

@@ -13,23 +13,6 @@ permissions:
 
 on:
   workflow_call:
-  pull_request:
-    # Main PRs skip it; nightly.yml runs it on main. `edited` catches a main PR
-    # retargeted to release. `closed` is here only so merging/closing a PR
-    # cancels its in-flight run via the concurrency group below; the job itself
-    # is skipped on close.
-    branches: [release]
-    types: [opened, synchronize, reopened, edited, closed]
-    paths:
-      - "cpp/moq/**"
-      - "cpp/justfile"
-      - "rs/moq-ffi/**"
-      - "sh/cpp/**"
-      - "rs/moq-c/native-libs/**"
-      - "doc/lib/cpp/**"
-      - "doc/lib/samples.sh"
-      - "Cargo.lock"
-      - ".github/workflows/cpp.yml"
 
 concurrency:
   group: cpp-${{ github.ref }}
@@ -38,7 +21,6 @@ concurrency:
 jobs:
   clang:
     name: C++ (clang)
-    if: github.event.action != 'closed'
     runs-on: ubuntu-24.04
     timeout-minutes: 60
 

.github/workflows/features.yml

@@ -5,9 +5,6 @@ permissions:
 
 on:
   workflow_call:
-  pull_request:
-    branches: [release]
-    types: [opened, synchronize, reopened, edited, closed]
 
 concurrency:
   group: features-${{ github.ref }}
@@ -16,7 +13,6 @@ concurrency:
 jobs:
   features:
     name: Features (${{ matrix.recipe }})
-    if: github.event.action != 'closed'
     runs-on: ubuntu-24.04-arm
     environment: ${{ github.ref == 'refs/heads/main' && 'cache-write' || '' }}
     timeout-minutes: 60

.github/workflows/interop.yml

@@ -10,28 +10,8 @@ on:
   # Nightly: catch an interop regression in the current tree before a user does.
   schedule:
     - cron: "0 8 * * *"
-  # On release PRs that touch the harness itself, so a backported change to the
-  # interop test is validated before it merges. Main PRs skip it; the schedule
-  # above covers main. `edited` catches a main PR retargeted to release.
-  pull_request:
-    branches: [release]
-    types: [opened, synchronize, reopened, edited]
-    paths:
-      - "test/lib/**"
-      - "test/p2p/**"
-      - "js/p2p/**"
-      - "test/interop/**"
-      - "test/max-age/**"
-      - "test/portrait/**"
-      - "rs/moq-tokio/tests/integration/max_age.rs"
-      # The interop job also depends on the recipe that invokes it and the
-      # workspace membership that links the JS clients to source.
-      - "test/justfile"
-      - "package.json"
-      # The Go client builds against the modules this script stages.
-      - "sh/go/**"
-      - "cpp/moq/**"
-      - ".github/workflows/interop.yml"
+  # release-gate.yml, on release PRs that touch the harness.
+  workflow_call:
 
 concurrency:
   group: interop-${{ github.ref }}

.github/workflows/moq-sh.yml

@@ -11,15 +11,10 @@ on:
     paths:
       - "infra/moq-sh/**"
       - ".github/workflows/moq-sh.yml"
-  pull_request:
-    # Main PRs skip it: the merge queue's Check runs its fixtures on Linux, and
-    # nightly.yml's platform.yml call runs them and the smoke on macOS. `edited`
-    # catches a main PR retargeted to release.
-    branches: [release]
-    types: [opened, synchronize, reopened, edited]
-    paths:
-      - "infra/moq-sh/**"
-      - ".github/workflows/moq-sh.yml"
+  # Release PRs, through release-gate.yml. Main PRs skip it: the merge queue's
+  # Check runs its fixtures on Linux, and nightly.yml's platform.yml call runs
+  # them and the smoke on macOS.
+  workflow_call:
   workflow_dispatch:
 
 permissions:

.github/workflows/nightly.yml

@@ -30,7 +30,7 @@ name: Nightly
 # Main PRs run no cloud CI beyond the merge queue's Check, so every
 # path-filtered gate (Android, C++, WASM, X11, the audio replays, the OSS
 # Scanner image, platform.yml and the release dry-runs) runs here on main too,
-# and on release PRs.
+# and release-gate.yml runs them on release PRs.
 #
 # A failure here lands on main rather than being caught in review, which is the
 # accepted trade. Anything that must block a merge belongs in check.yml.
@@ -173,7 +173,7 @@ jobs:
             artifact-path: target/coverage/js
           # OBS (over moq-ffi) and moq-c's C fixtures link a Rust staticlib from
           # outside cargo, so a stale `rs/moq-c/native-libs/*.txt` breaks them and
-          # no cargo build. obs.yml's path filter can't list every such input;
+          # no cargo build. release-gate.yml's OBS filter can't list every such input;
           # this diff-independent run catches what it misses, a day late.
           - name: OBS
             recipe: obs ci

.github/workflows/obs.yml

@@ -38,7 +38,7 @@ name: OBS
 # A list of paths still can't be complete here -- a vendored C source or a
 # .cargo/config.toml could do it too -- and `rs/**` would run this on nearly
 # every PR, which is the cost that removed the Windows and macOS gates (#2600).
-# So this filter covers the likely inputs at PR time, and pushes to `release`
+# So release-gate.yml's filter covers the likely inputs at PR time, and pushes to `release`
 # rebuild on any Rust or plugin change to cover the rest. Main PRs skip it:
 # nightly.yml runs the same Linux recipes on main diff-independently.
 
@@ -61,40 +61,19 @@ on:
       - "flake.nix"
       - "flake.lock"
       - ".github/workflows/obs.yml"
-  pull_request:
-    # `edited` catches a main PR retargeted to release. `closed` is here only so
-    # merging/closing a PR cancels its in-flight run via the concurrency group
-    # below; the job itself is skipped on close.
-    branches: [release]
-    types: [opened, synchronize, reopened, edited, closed]
-    paths:
-      - "cpp/obs/**"
-      - "cpp/moq/**"
-      - "sh/obs/**"
-      - "rs/moq-ffi/**"
-      - "rs/moq-c/**"
-      - "doc/lib/c/**"
-      - "doc/lib/samples.sh"
-      - "rs/**/Cargo.toml"
-      - "rs/**/build.rs"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "rust-toolchain.toml"
-      - "flake.nix"
-      - "flake.lock"
-      - ".github/workflows/obs.yml"
+  # Release PRs, through release-gate.yml.
+  workflow_call:
 
-# Keyed and cancelled like platform.yml: a merged PR's `closed` run must not
-# cancel the push run it triggers, and `release` can merge faster than a push
-# run finishes, so pushes queue rather than cancel.
+# Keyed and cancelled like platform.yml: a release PR's run must not cancel a
+# push run, and `release` can merge faster than a push run finishes, so pushes
+# queue rather than cancel.
 concurrency:
   group: obs-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build:
     name: OBS
-    if: github.event.action != 'closed'
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 60
 

.github/workflows/oss-scanner.yml

@@ -10,15 +10,6 @@ name: OSS Scanner
 # disk the ~20 GB scanner image needs, and the image brings its own toolchain.
 on:
   workflow_call:
-  pull_request:
-    # Main PRs skip it; nightly.yml runs it on main. `edited` catches a main PR
-    # retargeted to release.
-    branches: [release]
-    types: [opened, synchronize, reopened, edited]
-    paths:
-      - ".oss-scanner/**"
-      - "sh/oss-scanner.sh"
-      - ".github/workflows/oss-scanner.yml"
 
 permissions:
   contents: read

.github/workflows/platform.yml

@@ -1,7 +1,7 @@
 name: Platform
 
-# The native macOS and Windows gates run nightly on main (nightly.yml calls this)
-# and on every release PR, without path filters, so release can require their names.
+# The native macOS and Windows gates run nightly on main and on every release
+# PR (nightly.yml and release-gate.yml call this), selecting suites from the diff.
 permissions:
   contents: read
 
@@ -22,12 +22,6 @@ on:
       - "justfile"
       - "**/justfile"
       - ".github/**"
-  pull_request:
-    branches: [release]
-    # `closed` only cancels an in-flight run. `edited` runs the gates when a main
-    # PR is retargeted to release. Any edit reruns them, since a skipped rerun
-    # would post a passing context over a failed one.
-    types: [opened, synchronize, reopened, edited, closed]
   workflow_call:
     inputs:
       benchmarks:
@@ -52,10 +46,7 @@ env:
 
 jobs:
   scope:
-    # Require this check too: a failed selector otherwise skips its dependents,
-    # and GitHub accepts skipped jobs as successful required checks.
     name: Platform scope
-    if: github.event.action != 'closed'
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     outputs:

.github/workflows/release-dart-ffi.yml

@@ -12,20 +12,6 @@ on:
   # workflow this way so a broken build surfaces before the tag is cut.
   workflow_call:
   workflow_dispatch:
-  # Packaging changes only, like the other FFI release workflows. A change to
-  # the moq-ffi sources is covered on every platform by cheaper gates: check.yml
-  # compiles it and regenerates the Dart bindings, platform.yml compiles it for
-  # macOS, Windows, and iOS, and nightly runs this full matrix. Main PRs skip
-  # it; `edited` catches a main PR retargeted to release.
-  pull_request:
-    branches: [release]
-    types: [opened, synchronize, reopened, edited]
-    paths:
-      - ".github/workflows/release-dart-ffi.yml"
-      - ".github/workflows/release-ffi.yml"
-      - "dart/moq_ffi/**"
-      - "sh/dart/**"
-      - "rs/moq-ffi/build.sh"
 
 permissions:
   contents: read

.github/workflows/release-dart.yml

@@ -11,14 +11,6 @@ on:
   # Dry-run: check the source package, publish nothing. Only a tag push
   # publishes, so nightly.yml calls this on main in place of main PRs.
   workflow_call:
-  # `edited` catches a main PR retargeted to release.
-  pull_request:
-    branches: [release]
-    types: [opened, synchronize, reopened, edited]
-    paths:
-      - ".github/workflows/release-dart.yml"
-      - "dart/moq/**"
-      - "sh/dart/**"
 
 permissions:
   contents: read