From ac10d2e37506a4ffe5d6d5c2dc63d26f9fb3198b Mon Sep 17 00:00:00 2001
From: John McChesney TenEyck Jr <59268465+jmcte@users.noreply.github.com>
Date: Mon, 22 Jun 2026 09:44:09 +0100
Subject: [PATCH 1/2] ci: isolate PR checks from self-hosted runner

---
 .github/workflows/pr-fast-ci.yml | 18 +++++++++++++++++-
 scripts/ci/check-ci-policy.sh    |  1 +
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr-fast-ci.yml b/.github/workflows/pr-fast-ci.yml
index 6744f9a..cd042e2 100644
--- a/.github/workflows/pr-fast-ci.yml
+++ b/.github/workflows/pr-fast-ci.yml
@@ -9,8 +9,24 @@ on:
   workflow_dispatch:
 
 jobs:
-  ci-gate:
+  pr-ci-gate:
     name: CI Gate
+    if: github.event_name == 'pull_request'
+    runs-on:
+      - macos-15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Verify Xcode
+        run: xcodebuild -version
+
+      - name: Fast checks
+        run: bash scripts/ci/run-fast-checks.sh
+
+  trusted-ci-gate:
+    name: CI Gate
+    if: github.event_name != 'pull_request'
     runs-on:
       - self-hosted
       - macOS
diff --git a/scripts/ci/check-ci-policy.sh b/scripts/ci/check-ci-policy.sh
index 6ee3204..d1f3c98 100755
--- a/scripts/ci/check-ci-policy.sh
+++ b/scripts/ci/check-ci-policy.sh
@@ -49,6 +49,7 @@ fi
 
 if [[ -f "$workflow" ]]; then
   require_line "$workflow" "    types: [opened, synchronize, reopened, ready_for_review, edited]"
+  require_line "$workflow" "      - macos-15"
   require_contains "$workflow" "bash scripts/ci/run-fast-checks.sh"
 fi
 

From c96ab3e67a772d9c343a7922da5a9927840bce23 Mon Sep 17 00:00:00 2001
From: Hermes <Hermes-omt@protonmail.com>
Date: Tue, 23 Jun 2026 10:04:32 +0100
Subject: [PATCH 2/2] Make CI gate unambiguous

---
 .github/workflows/pr-fast-ci.yml | 21 ++++++++++++++++--
 scripts/ci/check-ci-policy.sh    | 37 +++++++++++++++++++++++++++++++-
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-fast-ci.yml b/.github/workflows/pr-fast-ci.yml
index cd042e2..d460394 100644
--- a/.github/workflows/pr-fast-ci.yml
+++ b/.github/workflows/pr-fast-ci.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   pr-ci-gate:
-    name: CI Gate
+    name: PR Checks
     if: github.event_name == 'pull_request'
     runs-on:
       - macos-15
@@ -25,7 +25,7 @@ jobs:
         run: bash scripts/ci/run-fast-checks.sh
 
   trusted-ci-gate:
-    name: CI Gate
+    name: Trusted Checks
     if: github.event_name != 'pull_request'
     runs-on:
       - self-hosted
@@ -43,3 +43,20 @@ jobs:
 
       - name: Fast checks
         run: bash scripts/ci/run-fast-checks.sh
+
+  ci-gate:
+    name: CI Gate
+    if: always()
+    needs:
+      - pr-ci-gate
+      - trusted-ci-gate
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - name: Require event-specific checks
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            [[ "${{ needs.pr-ci-gate.result }}" == "success" ]]
+          else
+            [[ "${{ needs.trusted-ci-gate.result }}" == "success" ]]
+          fi
diff --git a/scripts/ci/check-ci-policy.sh b/scripts/ci/check-ci-policy.sh
index d1f3c98..76eb86b 100755
--- a/scripts/ci/check-ci-policy.sh
+++ b/scripts/ci/check-ci-policy.sh
@@ -32,6 +32,36 @@ require_contains() {
   fi
 }
 
+job_block() {
+  local file="$1"
+  local job="$2"
+  awk -v job="  ${job}:" '
+    $0 == job { in_job = 1; print; next }
+    in_job && $0 ~ /^  [A-Za-z0-9_-]+:/ { exit }
+    in_job { print }
+  ' "$file"
+}
+
+require_job_line() {
+  local file="$1"
+  local job="$2"
+  local expected="$3"
+  if ! job_block "$file" "$job" | grep -F -x "$expected" >/dev/null 2>&1; then
+    echo "CI policy missing exact line in $workflow job $job: $expected" >&2
+    failed=1
+  fi
+}
+
+reject_job_contains() {
+  local file="$1"
+  local job="$2"
+  local rejected="$3"
+  if job_block "$file" "$job" | grep -F "$rejected" >/dev/null 2>&1; then
+    echo "CI policy rejected text in $workflow job $job: $rejected" >&2
+    failed=1
+  fi
+}
+
 require_file "$fast_script"
 require_file "$workflow"
 
@@ -49,7 +79,12 @@ fi
 
 if [[ -f "$workflow" ]]; then
   require_line "$workflow" "    types: [opened, synchronize, reopened, ready_for_review, edited]"
-  require_line "$workflow" "      - macos-15"
+  require_job_line "$workflow" "pr-ci-gate" "    name: PR Checks"
+  require_job_line "$workflow" "pr-ci-gate" "    if: github.event_name == 'pull_request'"
+  require_job_line "$workflow" "pr-ci-gate" "      - macos-15"
+  reject_job_contains "$workflow" "pr-ci-gate" "self-hosted"
+  require_job_line "$workflow" "ci-gate" "    name: CI Gate"
+  require_job_line "$workflow" "ci-gate" "    if: always()"
   require_contains "$workflow" "bash scripts/ci/run-fast-checks.sh"
 fi