@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/01-pr-fast.yml.ejs

@@ -0,0 +1,1089 @@
+<% const _lanes = Array.isArray(lanes) ? lanes : []; const _multiLane = _lanes.length >= 2; const _bs = (typeof branchingStrategy !== 'undefined' ? branchingStrategy : 'github-flow'); %><% const _collabMode = (typeof collaborationMode !== 'undefined' && collaborationMode) ? collaborationMode : undefined; const _humanApproval = _collabMode !== 'trunk-solo'; /* trunk-solo: the sole human is the PR author and cannot self-approve — drop the impossible gate (INV-74) */ %># Reference: docs/REFERENCE/workflow-pr-fast.md
+name: PR Fast (T1)
+
+permissions:
+  contents: read
+
+on:
+  push:
+<% if (_bs === 'github-flow-with-develop') { %>
+    branches: [main, develop]
+<% } else { %>
+    branches: [main]
+<% } %>
+  workflow_dispatch:
+  # #2476 — deliberately NO `branches:` filter on this trigger. On a pull_request
+  # event `branches:` filters the BASE branch, not the head, so the former
+  # `branches: [main]` created NO WORKFLOW RUN AT ALL for a pull request stacked on
+  # a task or train branch: it displayed no failing checks because it had no checks,
+  # and any "no failing checks ⇒ mergeable" read was satisfied by a pull request
+  # that was never tested. Branch protection is no backstop — protection is
+  # configured on the BASE branch and a task/train branch carries none. Run creation
+  # is therefore unconditional in the base branch; per-branch economy stays INSIDE
+  # the workflow, in the job-level `if:` guards below, where a skipped job still
+  # reports a result the `ci-required` aggregator reads. The `push:` trigger above
+  # keeps its branch list: that lane is the post-merge catch-net for long-lived
+  # branches, and widening it would multiply runner cost on every task-branch push
+  # for coverage this pull_request trigger already provides. #2486 separately keys
+  # PR concurrency by head AND base while preserving the push key. Base-trigger
+  # coverage is enforced by scripts/check-workflow-test-integrity.mjs.
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, ready_for_review, unlabeled]
+
+# Cancel in-progress runs on the same ref; main always completes (#357).
+concurrency:
+  group: pr-fast-${{ github.head_ref || github.ref_name }}${{ github.base_ref && format('-{0}', github.base_ref) || '' }}
+<% if (_bs === 'github-flow-with-develop') { %>
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}
+<% } else { %>
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+<% } %>
+
+jobs:
+  config-lint:
+    name: Config Lint (yaml + shell)
+    # gold-align (#1506 yamllint / #1507 shellcheck): a language-agnostic style/
+    # structure lint lane. yamllint checks non-workflow YAML (indentation, duplicate
+    # keys, trailing spaces, document structure) — complementary to actionlint, which
+    # owns .github/workflows *semantics*. shellcheck checks generated *.sh for unquoted
+    # expansions / unsafe word-splitting at warning severity. Both BLOCKING; both
+    # version-pinned for reproducibility. Each linter no-ops cleanly (green) when the
+    # repo carries no matching files. Committed .yamllint.yml / .shellcheckrc (when
+    # present) are auto-discovered and make the rules explicit + tunable.
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Install shellcheck (pinned)
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          curl -sSfL https://github.com/koalaman/shellcheck/releases/download/v0.10.0/shellcheck-v0.10.0.linux.x86_64.tar.xz \
+            | tar -xJ -C "$RUNNER_TEMP/bin" --strip-components=1 shellcheck-v0.10.0/shellcheck
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: shellcheck (generated shell, blocking at warning severity)
+        # .shellcheckrc (when present) is auto-discovered. No *.sh ⇒ no-op (green).
+        run: |
+          files=$(git ls-files '*.sh')
+          if [ -n "$files" ]; then
+            echo "$files" | xargs shellcheck --severity=warning
+          else
+            echo "shellcheck: no *.sh files — skipping"
+          fi
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Install yamllint (pinned)
+        run: pip install yamllint==1.35.1
+      - name: yamllint (non-workflow YAML, blocking on errors)
+        # actionlint owns .github/workflows semantics; exclude them to avoid overlap.
+        # A committed .yamllint.yml (when present) is auto-discovered and authoritative;
+        # otherwise fall back to yamllint's built-in `relaxed` preset — both block on
+        # ERRORS only (line-length etc. stay advisory warnings). No matching YAML ⇒ no-op.
+        run: |
+          files=$(git ls-files '*.yml' '*.yaml' ':!.github/workflows/**')
+          if [ -n "$files" ]; then
+            if [ -f .yamllint.yml ] || [ -f .yamllint.yaml ] || [ -f .yamllint ]; then
+              echo "$files" | xargs yamllint
+            else
+              echo "$files" | xargs yamllint -d relaxed
+            fi
+          else
+            echo "yamllint: no non-workflow YAML — skipping"
+          fi
+<% if (locals.enableSoloDevMode) { %>
+  solo-dev-gate:
+    name: Solo-Dev Gate (INV-59)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - run: echo "solo-dev mode — local L2 gate guards merge via INV-59 parity check"
+<% } else { %><% if (enableSecurityScanning) { %>
+  security-early-fail:
+    name: Security (PII + Secrets)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          package-manager-cache: false
+      - name: PII scan (INV-12, HARD)
+        run: node scripts/pii-scan.mjs
+      - name: Install gitleaks
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.27.2/gitleaks_8.27.2_linux_x64.tar.gz | tar -xz -C "$RUNNER_TEMP/bin" gitleaks
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: Gitleaks secrets scan (INV-11)
+        # --log-opts="HEAD" (#1908): without it, gitleaks defaults to scanning
+        # ALL refs reachable in the checkout's object DB (fetch-depth: 0 above
+        # fetches every remote branch, not just this one). That let an unrelated,
+        # unmerged branch's commit cross-contaminate every other PR's scan.
+        # Scoping to HEAD still walks this ref's FULL history (no depth lost) —
+        # it just stops other branches' commits from being scanned here. The
+        # nightly `gitleaks-history` job intentionally keeps `--all --full-history`
+        # as the deep, cross-branch safety net.
+        run: |
+          gitleaks detect --source . --config .gitleaks.toml \
+            --gitleaks-ignore-path suppressions/.gitleaksignore \
+            --log-opts="HEAD" \
+            --exit-code 1 --redact
+<% } %>
+<% if (governanceLevel !== 'L1' || _multiLane) { %>
+  classify-changes:
+    name: Classify Changes
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    outputs:
+      docs_only: ${{ steps.classify.outputs.docs_only }}
+      backend_changed: ${{ steps.classify.outputs.backend_changed }}
+      frontend_changed: ${{ steps.classify.outputs.frontend_changed }}
+      infra_changed: ${{ steps.classify.outputs.infra_changed }}
+      high_risk: ${{ steps.classify.outputs.high_risk }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          package-manager-cache: false
+      - id: classify
+        if: hashFiles('scripts/ci-classify-changes.mjs') != ''
+        run: node scripts/ci-classify-changes.mjs
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || 'origin/main' }}
+          HEAD_SHA: ${{ github.sha }}
+<% } %>
+<% if (_multiLane) { %>
+  cross-stack-guard:
+    name: Cross-Stack Guard
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    needs: [classify-changes]
+    if: github.event_name == 'pull_request'
+    permissions:
+      pull-requests: write
+    steps:
+<% if (isL3Plus) { %>
+      - name: Enforce cross-stack split
+        if: needs.classify-changes.outputs.backend_changed == 'true' && needs.classify-changes.outputs.frontend_changed == 'true'
+        run: |
+          echo "::error::This PR touches both frontend and backend lanes. Split into separate PRs."
+          exit 1
+<% } else { %>
+      - name: Warn cross-stack changes
+        if: needs.classify-changes.outputs.backend_changed == 'true' && needs.classify-changes.outputs.frontend_changed == 'true'
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '> [!WARNING]\n> This PR touches both **frontend** and **backend** lanes. Consider splitting into separate PRs for cleaner review and safer deployment.'
+            })
+<% } %>
+<% } %>
+<% if (enableSecurityScanning) { %>  dependency-review:
+    name: Dependency Review (supply-chain)
+    # A1 (#1502): the canonical FAST PR supply-chain gate. dependency-review-action
+    # diffs the PR's dependency-manifest changes and fails on a newly-introduced
+    # vulnerable dependency — keeping slow full-tree scanners off the always-path.
+    # PR-only (the action diffs base...head and errors on push). Fail severity is
+    # configurable via the DEPENDENCY_REVIEW_FAIL_SEVERITY repo variable (default: high).
+    # Floor: enableSecurityScanning — the same always-path gate as security-early-fail.
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    # PR-only AND GHAS-gated (#1685): dependency-review-action HARD-errors when the
+    # repo lacks Dependency Graph + GitHub Advanced Security, which reds every PR
+    # while GHAS is off. A JOB-LEVEL guard makes the job SKIP (result=skipped, which
+    # the ci-required aggregator treats as non-failure) until GHAS is enabled by
+    # setting the GHAS_ENABLED repo variable to 'true'. NOT step-level
+    # continue-on-error: that would violate INV-80 and silently neuter the gate once
+    # GHAS is on. With the var set, a real finding still fails the job and blocks.
+    if: github.event_name == 'pull_request' && vars.GHAS_ENABLED == 'true'
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Dependency review (fail on newly-introduced high-severity deps)
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
+        with:
+          fail-on-severity: ${{ vars.DEPENDENCY_REVIEW_FAIL_SEVERITY || 'high' }}
+<% } %>
+<% if (governanceLevel !== 'L1' || _multiLane) { %>  iac-scan:
+    name: IaC Scan (infra-changed)
+    # A1 (#1502): consume the classify-changes `infra_changed` signal (previously
+    # classified but UNUSED) — scan terraform / kubernetes / dockerfile only when the
+    # PR actually touches infrastructure-as-code, keeping the always-path lean.
+    # #1785: was pinned to a LITERAL `runs-on: ubuntu-latest` on the (disproven)
+    # assumption that GitHub-hosted runners are never containerized (#1756).
+    # Evidence (run 28693108584) showed a job pinned to literal `ubuntu-latest`
+    # actually serviced by self-hosted `arbiter-slot-build-3` — the label alone
+    # never guaranteed real GitHub-hosted infra here. Rather than keep trusting
+    # an unverified runner label, Checkov now runs as a plain pip-installed CLI
+    # (bridgecrewio/checkov-action was only a Docker convenience wrapper around
+    # it) — no docker-container action, no workspace bind-mount, the whole
+    # defect class sidestepped entirely (same pattern as the osv-scanner static-
+    # binary fix, #1767). Enforced by scripts/check-docker-action-runner-safety.mjs.
+    # #1894: routed through the same `RUNNER_LABELS_TEST` expression as every other
+    # job. The former literal `ubuntu-latest` used to be intercepted by the self-
+    # hosted fleet (#1785 evidence), but the fleet dropped the `ubuntu-latest`
+    # label, so the literal pin fell through to real GitHub-hosted infra and failed
+    # (spending-limit block). The expression defaults to `["ubuntu-latest"]` when
+    # the var is unset (consumers unaffected); arbiter's own repo sets it to the
+    # self-hosted labels. Checkov/tflint are plain CLIs (no docker-action), so the
+    # runner class remains moot for the #1785 safety class either way.
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    needs: [classify-changes]
+    if: needs.classify-changes.outputs.infra_changed == 'true'
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Install Checkov (pinned, no Docker — #1785)
+        run: pip install checkov==3.3.7
+      - name: Checkov IaC scan (<%= locals.checkovSelfScope ? 'terraform/kubernetes/dockerfile' : 'all frameworks' %>)
+        run: |
+<% if (locals.checkovSelfScope) { -%>
+          # #1685 (arbiter self-scan): `all` over-scoped THIS repo (github_actions
+          # + secrets policies across dozens of workflows/fixtures) even though
+          # arbiter carries ZERO terraform/kubernetes/dockerfile IaC — redding
+          # self-CI. `--framework` takes repeated values (checkov's own nargs='+'
+          # CLI, no word-splitting footgun now that the docker-action wrapper is
+          # gone, #1785): 0 findings — honestly SCOPED, not soft-fail-suppressed.
+          # Hard-fail stays checkov's default (no soft-fail flag passed): a real
+          # misconfig would still block (INV-80). Self-only; consumers (the
+          # shipped template's `else` branch below) are NOT affected.
+          checkov --directory . --framework terraform kubernetes dockerfile --quiet --compact
+<% } else { -%>
+          # #1685: `all` is checkov's documented-valid multi-framework value (also
+          # its own default scope). Hard-fail stays the default (no soft-fail
+          # flag passed): a real misconfiguration must block (INV-80).
+          checkov --directory . --framework all --quiet --compact
+<% } -%>
+      # #1509 gold-align: Checkov scans for known misconfigurations; tflint is the
+      # Terraform-specific *linter* (provider-aware deprecations, invalid arg
+      # combinations, unused declarations). Reference-grade IaC pipelines run it
+      # BLOCKING — no soft-fail. `--recursive` exits 0 when the repo carries no
+      # `.tf` files, so non-Terraform infra changes (k8s/dockerfile) stay green.
+      - name: Setup tflint (Terraform linter)
+        uses: terraform-linters/setup-tflint@6e1e0642c0289bd619021bf6b34e3c08ed1e005a  # v6.3.0
+      - name: tflint (Terraform lint, blocking)
+        run: tflint --recursive --no-color
+<% } %>
+<% if (language === 'typescript') { %>
+<% const _tsNeeds=[]; if(enableSecurityScanning) _tsNeeds.push('security-early-fail'); if(governanceLevel !== 'L1' || _multiLane) _tsNeeds.push('classify-changes'); %>
+<% if (locals.ciPreTestBuild) { %>  build-workspace:
+    name: Build Workspace (cache)
+    # E2 (#1500): build dist ONCE and share it run-id-keyed via the build-cache
+    # composite, instead of unit/contract/integration/behavioral each re-running
+    # `npm run build`. The composite's restore is non-blocking (cache miss ⇒ rebuild).
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+<% { const _bwNeeds=[]; if(governanceLevel !== 'L1' || _multiLane) _bwNeeds.push('classify-changes'); if(_bwNeeds.length){ %>    needs: [<%= _bwNeeds.join(', ') %>]
+<% } if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: Build + cache workspace (shared via run-id key)
+        uses: ./.github/actions/build-cache
+        with:
+          op: save
+
+<% } %>  gate:
+    name: Lint + Typecheck
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+<% if(_tsNeeds.length){ %>    needs: [<%= _tsNeeds.join(', ') %>]
+<% } if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: ./.github/actions/setup-node-pnpm
+      - run: npm run typecheck
+      - run: npm run lint
+<% if (enableSecurityScanning) { %>
+      - name: Dep audit (INV-13)
+        run: npm audit --omit=dev --audit-level=high
+<% } %>
+
+<% if (!locals.enableNativeBakeE2E) { %>  unit-tests:
+    name: Unit Tests
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    needs: [gate<% if (language === 'typescript' && locals.ciPreTestBuild) { %>, build-workspace<% } %><% if(governanceLevel !== 'L1' || _multiLane){ %>, classify-changes<% } %>]
+    strategy:
+      max-parallel: 2
+<% if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          # TDD evidence can name an older commit; reachability requires history.
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-node-pnpm
+<% if (locals.ciPreTestBuild) { %>      - name: Restore cached workspace build (non-blocking)
+        uses: ./.github/actions/build-cache
+        with:
+          op: restore
+      - run: node scripts/build-kit.mjs
+<% } %>      - name: Install psmisc (fuser — #2098 gate-exec queue-depth advisory)
+        # scripts/lib/waiter-count.mjs shells out to `fuser` to count real flock
+        # waiters; unlike gitleaks/actionlint (single-binary GitHub-release
+        # tarballs, pinned in scripts/ci-tools.json), psmisc has no such release
+        # artifact, so apt is the install path here. flock itself (util-linux)
+        # is already present on the runner image; only fuser (psmisc) is missing.
+        # Root (self-hosted) uses apt-get directly; non-root (e.g. GitHub-hosted
+        # ubuntu-latest, where every consumer of this template lands by default)
+        # needs sudo. Skip entirely if fuser is already on PATH.
+        run: |
+          if ! command -v fuser >/dev/null 2>&1; then
+            if [ "$(id -u)" -eq 0 ]; then
+              apt-get update -qq && apt-get install -y -qq psmisc
+            else
+              sudo apt-get update -qq && sudo apt-get install -y -qq psmisc
+            fi
+          fi
+      # `--reporter=junit` ALONE replaces the console reporter, so a failing run
+      # names no test in the job log — the only record is the uploaded junit.xml,
+      # which is unreadable from a webhook or a log tail. Both reporters are
+      # passed so the log stays diagnosable and the artifact keeps its schema;
+      # `--outputFile.junit=` is the per-reporter form vitest requires once more
+      # than one reporter is active.
+      - run: npm run test:unit<% if (enableDebtGates) { %> -- --reporter=default --reporter=junit --outputFile.junit=test-results/junit.xml<% } %>
+<% if (enableDebtGates) { %>
+      - name: Upload test results
+        id: upload-test-results
+        if: always()
+        # Supplementary artifact — never let an Artifacts-quota hiccup fail the
+        # job whose actual signal (the test run above) already passed.
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: test-results-unit-${{ github.run_id }}
+          path: test-results/
+          retention-days: 7
+<% } %>
+<% } -%>
+<%# #1875: contract-tests/integration-tests/behavioral-tests moved OFF the
+    always-run T1 lane to 02-pr-extended.yml.ejs (T2, conditionally triggered).
+    They used to fan out from `gate` unconditionally on every PR — on arbiter's
+    own dogfooded CI, `contract-tests` alone measured ~12min, blowing the
+    15min T1 budget (ADR-090). docs/REFERENCE/ci-tier-workflows.md already
+    documented the "Extended gate" tier as the correct home for this suite;
+    the template just hadn't caught up. -%>
+
+<% } %><% if (language === 'rust') { %>
+  gate:
+    name: Lint + Test (Rust)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+<% { const _n=[]; if(enableSecurityScanning) _n.push('security-early-fail'); if(governanceLevel !== 'L1' || _multiLane) _n.push('classify-changes'); if(_n.length){ %>    needs: [<%= _n.join(', ') %>]
+<% } if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+      - run: cargo fmt --check
+      - run: cargo clippy -- -D warnings
+      - run: cargo test
+<% if (enableSecurityScanning) { %>
+      - name: Dep audit (INV-13)
+        uses: rustsec/audit-check@e9159ac5f7d7d873ce074ca134da2f445c0a4a61  # v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+<% } %>
+<% } %><% if (language === 'java') { %>
+<% const _javaNeeds=[]; if(enableSecurityScanning) _javaNeeds.push('security-early-fail'); if(governanceLevel !== 'L1' || _multiLane) _javaNeeds.push('classify-changes'); %>
+<% /* #1278: build-reactor runs in PARALLEL with security-early-fail (not after it) to keep the maven critical path under the 15m T1 budget. security still HARD-blocks merge via ci-required, and `gate` (lint) still gates on it, preserving the early-fail signal on the lint lane. Tradeoff: wasted compile compute on a security-failing PR — not lost coverage or developer feedback. */ const _reactorNeeds=[]; if(governanceLevel !== 'L1' || _multiLane) _reactorNeeds.push('classify-changes'); %>
+<% if (buildTool === 'maven') { %>  build-reactor:
+    name: Build Maven Reactor (#1226)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    permissions:
+      contents: read
+<% if(_reactorNeeds.length){ %>    needs: [<%= _reactorNeeds.join(', ') %>]
+<% } if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: ./.github/actions/setup-java-maven
+      - name: Pre-fetch plugins and dependencies (offline cache)
+        run: mvn dependency:go-offline --batch-mode -q
+      - name: Build reactor (compile main + test classes, skip test execution)
+        # -DskipTests runs the test-compile phase but skips execution, so
+        # target/classes and target/test-classes are produced once here and
+        # reused by every test job below — no per-job recompile (#1278).
+        run: mvn --batch-mode -DskipTests install
+      - name: Pack M2 repository + compiled target/ trees
+        # m2-reactor.tar stays byte-identical to its prior form (rooted at $HOME/.m2).
+        # target-reactor.tar is additive (#1278): every module's compiled target/
+        # (main + test classes) in its own tar rooted at the workspace, so downstream
+        # run-only test goals (surefire:test) never recompile.
+        run: |
+          mkdir -p "${{ runner.temp }}/.m2-reactor"
+          tar -cf "${{ runner.temp }}/.m2-reactor/m2-reactor.tar" -C "$HOME/.m2" repository
+          find . -type d -name target -prune -print0 \
+            | tar -cf "${{ runner.temp }}/.m2-reactor/target-reactor.tar" --null -T -
+      - name: Upload reactor M2 + target artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: reactor-m2-${{ github.run_id }}
+          path: ${{ runner.temp }}/.m2-reactor/*.tar
+          retention-days: 7
+          overwrite: true
+
+<% } %>  gate:
+    name: Lint (Java)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+<% { const _gateNeeds=[..._javaNeeds]; if(buildTool === 'maven') _gateNeeds.push('build-reactor'); if(_gateNeeds.length){ %>    needs: [<%= _gateNeeds.join(', ') %>]
+<% } if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: ./.github/actions/setup-java-maven
+<% if (buildTool === 'gradle') { %>      - uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70  # v3
+      - run: ./gradlew checkstyleMain
+<%# E1 (#1502): Trivy fs (dep CVE) runs at nightly cadence in 06-nightly
+    `dep-cve-refresh`, not on the PR gate. The INV-13 dep-audit floor for java is
+    preserved there. -%>
+<% } else { %>      - name: Download reactor M2 artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: reactor-m2-${{ github.run_id }}
+          path: ${{ runner.temp }}/.m2-reactor
+      - run: mvn checkstyle:check --offline
+<%# E1 (#1502): Trivy fs (dep CVE) runs at nightly cadence in 06-nightly `dep-cve-refresh`. -%>
+<% } %>
+
+  unit-tests:
+    name: Unit Tests (Java)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+<% if(buildTool === 'maven'){ /* tests need compiled classes from build-reactor, not lint; off the gate hop (#1278) */ %>    needs: [build-reactor<% if(governanceLevel !== 'L1' || _multiLane){ %>, classify-changes<% } %>]
+<% } else { %>    needs: [gate<% if (language === 'typescript' && locals.ciPreTestBuild) { %>, build-workspace<% } %><% if(governanceLevel !== 'L1' || _multiLane){ %>, classify-changes<% } %>]
+<% } %>    strategy:
+      max-parallel: 2
+<% if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: ./.github/actions/setup-java-maven
+<% if (buildTool === 'gradle') { %>      - uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70  # v3
+      - run: ./gradlew test
+<% if (enableDebtGates) { %>
+      - name: Upload test results
+        id: upload-test-results
+        if: always()
+        # Supplementary artifact — never let an Artifacts-quota hiccup fail the
+        # job whose actual signal (the test run above) already passed.
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: test-results-unit-${{ github.run_id }}
+          path: build/test-results/
+          retention-days: 7
+<% } %>
+<% } else { %>      - name: Download reactor M2 artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: reactor-m2-${{ github.run_id }}
+          path: ${{ runner.temp }}/.m2-reactor
+      - run: mvn surefire:test -Punit --offline
+<% if (enableDebtGates) { %>
+      - name: Upload test results
+        id: upload-test-results
+        if: always()
+        # Supplementary artifact — never let an Artifacts-quota hiccup fail the
+        # job whose actual signal (the test run above) already passed.
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: test-results-unit-${{ github.run_id }}
+          path: target/surefire-reports/
+          retention-days: 7
+<% } %>
+<% } %>
+
+<% if (governanceLevel !== 'L1') { %>  archunit-tests:
+    name: ArchUnit Architecture Tests (Java)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    # #1512 gold-align: the lightweight *ArchTest JUnit5 architecture rules
+    # (dependency-direction / layering / package-boundary) run BLOCKING on EVERY PR.
+    # Previously they ran only on the weekly 13-archunit-extended cron, leaving up to a
+    # 7-day fake-green window for a merged architecture regression. The heavier
+    # full module-graph analysis (the Modulith suite) stays on that weekly cron.
+<% if(buildTool === 'maven'){ %>    needs: [build-reactor<% if(governanceLevel !== 'L1' || _multiLane){ %>, classify-changes<% } %>]
+<% } else { %>    needs: [gate<% if(governanceLevel !== 'L1' || _multiLane){ %>, classify-changes<% } %>]
+<% } %><% if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: ./.github/actions/setup-java-maven
+<% if (buildTool === 'gradle') { %>      - uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70  # v3
+      - run: ./gradlew test --tests "*ArchTest"
+<% } else { %>      - name: Download reactor M2 artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: reactor-m2-${{ github.run_id }}
+          path: ${{ runner.temp }}/.m2-reactor
+      - run: mvn surefire:test -Dtest="*ArchTest" --offline
+<% } %>
+<% } %>
+<%# #1875: contract-tests/integration-tests/behavioral-tests (Java) moved OFF
+    the always-run T1 lane to 02-pr-extended.yml.ejs (T2, conditionally
+    triggered) — mirrors the TypeScript move above. -%>
+
+<% } %><% if (language === 'go') { %>
+  gate:
+    name: Lint + Test (Go)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+<% { const _n=[]; if(enableSecurityScanning) _n.push('security-early-fail'); if(governanceLevel !== 'L1' || _multiLane) _n.push('classify-changes'); if(_n.length){ %>    needs: [<%= _n.join(', ') %>]
+<% } if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+      - run: go vet ./...
+      - run: golangci-lint run
+      - run: go test ./... -race -coverprofile=coverage.out
+<% if (enableSecurityScanning) { %>
+      - name: Dep audit govulncheck (INV-13)
+        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee  # v1
+        with:
+          # The action re-checkouts by default; after the explicit checkout above the
+          # second internal checkout adds a duplicate Authorization extraheader and
+          # git fails with 400 "Duplicate header" on private repos (#1865).
+          repo-checkout: false
+<% } %>
+<% } %><% if (language === 'python') { %>
+  gate:
+    name: Lint + Test (Python)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+<% { const _n=[]; if(enableSecurityScanning) _n.push('security-early-fail'); if(governanceLevel !== 'L1' || _multiLane) _n.push('classify-changes'); if(_n.length){ %>    needs: [<%= _n.join(', ') %>]
+<% } if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - run: pip install -e ".[dev]"
+      - run: ruff check .
+      - run: ruff format --check .
+      - run: pytest --cov --junitxml=test-results/junit.xml
+<% if (enableSecurityScanning) { %>
+      - name: Dep audit (INV-13)
+        run: pip-audit
+<% } %>
+<% if (enableDebtGates) { %>
+      - name: Upload test results
+        id: upload-test-results
+        if: always()
+        # Supplementary artifact — never let an Artifacts-quota hiccup fail the
+        # job whose actual signal (the test run above) already passed.
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: test-results-${{ github.run_id }}
+          path: test-results/
+          retention-days: 7
+<% } %>
+<% } %>
+
+<% if (governanceLevel !== 'L1') { %>
+  docs-check:
+    name: Docs Check
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Check docs updated with code changes
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          # #356: rebased-aware via merge-base; bypass via [skip-docs] commit token.
+          MB=$(git merge-base "$BASE_SHA" "$HEAD_SHA" || echo "$BASE_SHA")
+          CHANGED=$(git diff --name-only "$MB" "$HEAD_SHA")
+          LOG=$(git log --format=%B "$MB..$HEAD_SHA" || true)
+
+          HAS_CODE=$(echo "$CHANGED" | grep -E '^(src/|__tests__/)' || true)
+          HAS_DOCS=$(echo "$CHANGED" | grep -E '^(docs/|README\.md)' || true)
+          BYPASS=$(echo "$LOG" | grep -F '[skip-docs]' || true)
+
+          if [ -n "$HAS_CODE" ] && [ -z "$HAS_DOCS" ] && [ -z "$BYPASS" ]; then
+            echo "::error::Code changed without documentation update"
+            echo ""
+            echo "Files changed in src/ or __tests__/:"
+            echo "$HAS_CODE"
+            echo ""
+            echo "Please update docs/ or README.md, or add [skip-docs] to a commit message to bypass."
+            exit 1
+          fi
+          echo "Docs check passed."
+<% } %>
+
+<% if (enableDebtGates) { %>
+  debt-gates:
+    name: Tech Debt Gates
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    needs: [gate]
+    # E1 (#1502): the PR leg keeps only the FAST static-analysis gates
+    # (knip/madge/pmd/spotbugs/clippy/ruff/golangci). The whole-suite coverage
+    # re-run that used to live here was a SECOND full test execution on the PR
+    # (the unit/integration jobs already ran the suite, and `gate-full` runs
+    # check-all L2 which enforces the coverage threshold). The threshold floor is
+    # therefore preserved on PR via gate-full; the heavy coverage report (HTML/lcov
+    # artifact) is produced at nightly cadence in 06-nightly `coverage-report`.
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+<% if (locals.ciPreTestBuild) { %>      - run: npm run build && node scripts/build-kit.mjs
+<% } %>      - run: npx knip
+      - run: npx madge --circular --extensions ts,tsx,js,jsx src
+<% } %><% if (language === 'rust') { %>
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+      - run: cargo clippy -- -W clippy::pedantic -D warnings
+<% } %><% if (language === 'java') { %>
+      - uses: ./.github/actions/setup-java-maven
+<% if (buildTool === 'gradle') { %>      - uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70  # v3
+      - run: ./gradlew pmdMain
+      - run: ./gradlew spotbugsMain
+<% } else { %>      - name: Download reactor M2 artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: reactor-m2-${{ github.run_id }}
+          path: ${{ runner.temp }}/.m2-reactor
+      - run: mvn pmd:check --offline
+      - run: mvn spotbugs:check --offline
+<% } %><% } %><% if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+      - run: golangci-lint run --enable gocyclo,gocognit,deadcode,unused
+<% } %><% if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - run: pip install -e ".[dev]"
+      - run: ruff check --select C901,PLR0911,PLR0912,PLR0913,PLR0915 .
+      - run: ruff check --select F401,F811 .
+<% } %>
+<% } %>
+
+<% if (governanceLevel !== 'L1') { %>
+  sonar-scan:
+    name: SonarCloud Scan
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    needs: [gate]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+<% if (language === 'java') { %>
+      - uses: ./.github/actions/setup-java-maven
+<% if (buildTool === 'gradle') { %>      - uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70  # v3
+<% } %><% } else if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+<% } %>
+<% const _sonarCmd = (language === 'java' && buildTool === 'gradle') ? './gradlew sonarqube' : (language === 'java') ? 'mvn sonar:sonar' : 'npx sonar-scanner'; %>
+      - name: SonarCloud Scan (PR decoration — incremental new-code analysis)
+        # E1 (#1502): on PRs Sonar runs in pull-request mode — it decorates the PR
+        # with new-code findings only (incremental), NOT a full deep scan. The full
+        # branch baseline runs on merge-to-main below and nightly (06-nightly
+        # `sonar-deep-scan`), keeping the PR path fast.
+        if: env.SONAR_TOKEN != '' && github.event_name == 'pull_request'
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          # untrusted refs pass through env (never inlined into the script body).
+          PR_KEY: ${{ github.event.pull_request.number }}
+          PR_BRANCH: ${{ github.head_ref }}
+          PR_BASE: ${{ github.base_ref }}
+        run: |
+          <%= _sonarCmd %> -Dsonar.token="$SONAR_TOKEN" \
+            -Dsonar.pullrequest.key="$PR_KEY" \
+            -Dsonar.pullrequest.branch="$PR_BRANCH" \
+            -Dsonar.pullrequest.base="$PR_BASE"
+      - name: SonarCloud Scan (full branch baseline)
+        # Push to a long-lived branch refreshes the full-project baseline so the
+        # PR decoration above has a fresh reference to diff new code against.
+        if: env.SONAR_TOKEN != '' && github.event_name != 'pull_request'
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          <%= _sonarCmd %> -Dsonar.token="$SONAR_TOKEN"
+<% } %>
+
+<% if (contractType && contractType !== 'none' && governanceLevel !== 'L1') { %>
+
+  contract-verify:
+    name: Contract Verify
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    needs: [gate]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+<% if (contractType === 'rest-owned' || contractType === 'rest-public') { %>
+      - name: Run Pact contract tests
+        if: vars.PACT_BROKER_BASE_URL != ''
+        run: npx pact-broker can-i-deploy --pacticipant <%= projectName %> --latest
+        env:
+          PACT_BROKER_BASE_URL: ${{ vars.PACT_BROKER_BASE_URL }}
+          PACT_BROKER_TOKEN: ${{ secrets.PACT_BROKER_TOKEN }}
+<% } else if (contractType === 'graphql') { %>
+      - name: Run GraphQL schema contract tests
+        run: npx graphql-inspector diff schema.graphql
+<% } else if (contractType === 'grpc') { %>
+      - name: Run gRPC contract tests
+        run: npx buf breaking --against .git#branch=main
+<% } else if (contractType === 'message-queue') { %>
+      - name: Run Pact messaging contract tests
+        if: vars.PACT_BROKER_BASE_URL != ''
+        run: npx pact-broker can-i-deploy --pacticipant <%= projectName %> --latest
+        env:
+          PACT_BROKER_BASE_URL: ${{ vars.PACT_BROKER_BASE_URL }}
+          PACT_BROKER_TOKEN: ${{ secrets.PACT_BROKER_TOKEN }}
+<% } %>
+<% } else if (language === 'java') { %>
+      - uses: ./.github/actions/setup-java-maven
+<% if (buildTool === 'gradle') { %>      - uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70  # v3
+<% } %>
+<% if (contractType === 'rest-owned' || contractType === 'rest-public' || contractType === 'message-queue') { %>
+      - name: Run Pact contract tests
+        if: vars.PACT_BROKER_BASE_URL != ''
+        run: <%= buildTool === 'gradle' ? './gradlew pactPublish pactVerify' : 'mvn pact:publish pact:verify' %>
+        env:
+          PACT_BROKER_BASE_URL: ${{ vars.PACT_BROKER_BASE_URL }}
+          PACT_BROKER_TOKEN: ${{ secrets.PACT_BROKER_TOKEN }}
+<% } else if (contractType === 'graphql') { %>
+      - name: Run GraphQL contract tests
+        run: <%= buildTool === 'gradle' ? './gradlew test --tests *.graphql.*' : 'mvn test -Dtest=*GraphQL*' %>
+<% } else if (contractType === 'grpc') { %>
+      - name: Run gRPC contract tests
+        run: <%= buildTool === 'gradle' ? './gradlew test --tests *.grpc.*' : 'mvn test -Dtest=*Grpc*' %>
+<% } %>
+<% } else if (language === 'rust') { %>
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+      - name: Run contract tests
+        run: cargo test --test '*contract*'
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+      - name: Run contract tests
+        run: go test -tags contract -run Contract ./...
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - run: pip install -e ".[dev]"
+      - name: Run contract tests
+        run: pytest tests/contract/
+<% } %>
+<% } %>
+<% if (governanceLevel !== 'L1') { %>
+  gate-full:
+    name: Full Gate (L2, INV-59)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+<%  { const _n=[]; if(enableSecurityScanning) _n.push('security-early-fail'); _n.push('classify-changes'); %>
+    needs: [<%= _n.join(', ') %>]
+    if: needs.classify-changes.outputs.docs_only != 'true'
+<%  } %>
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+<% } else { %>
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          package-manager-cache: false
+<% } %>
+      - name: Install gitleaks
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.27.2/gitleaks_8.27.2_linux_x64.tar.gz | tar -xz -C "$RUNNER_TEMP/bin" gitleaks
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: Install actionlint
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          curl -sSfL https://github.com/rhysd/actionlint/releases/download/v1.7.3/actionlint_1.7.3_linux_amd64.tar.gz | tar -xz -C "$RUNNER_TEMP/bin" actionlint
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: Install psmisc (fuser — #2098 gate-exec queue-depth advisory)
+        # Mirrors the identical step in the Unit Tests job (see there for the
+        # full rationale) so this job's own gate-exec queue-depth advisory
+        # works too, independent of whether Unit Tests already ran on this
+        # runner. For arbiter's own repo, `check-all.mjs L2` below also runs
+        # the waiter-count/gate-exec test suite directly.
+        run: |
+          if ! command -v fuser >/dev/null 2>&1; then
+            if [ "$(id -u)" -eq 0 ]; then
+              apt-get update -qq && apt-get install -y -qq psmisc
+            else
+              sudo apt-get update -qq && sudo apt-get install -y -qq psmisc
+            fi
+          fi
+      - name: Build
+        run: npm run build<% if (locals.ciPreTestBuild) { %> && node scripts/build-kit.mjs<% } %>
+      - name: Gate-spine erosion ratchet (#2291)
+        # DELIBERATELY its own step, ahead of and independent of check-all.mjs.
+        # This gate fails when `arbiter update` had to WITHHOLD a protected file —
+        # most importantly scripts/check-all.mjs itself, the file where this project
+        # wires its own checks. Registering it only in gate-registry.yml would deliver
+        # it through scripts/check-all.mjs, i.e. through the very file being withheld:
+        # on a project whose spine is frozen the ratchet would never run, and the
+        # erosion it exists to catch would stay invisible for exactly as long as it
+        # matters. Workflows are arbiter-owned and are not withheld, so this step
+        # reaches a frozen consumer. Do not fold it into the gate step below.
+        run: node scripts/check-safety-adopt-ratchet.mjs
+      - name: Run full L2 gate (== pre-push)
+        run: node scripts/check-all.mjs L2 --json gate-result.json
+      - name: Upload gate-result artifact (activates INV-59 runtime parity)
+        id: upload-gate-result
+        if: always()
+        # check-local-ci-parity.mjs already treats a missing gate-result artifact
+        # as a graceful skip, not a hard failure — an Artifacts-quota hiccup on
+        # this upload must not fail the job the real gate already ran in.
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: gate-result
+          path: gate-result.json
+          retention-days: 7
+<% } %>
+
+<% if (_humanApproval) { %>  human-approval-required:
+    name: Human Approval Required (INV-74)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Assert approved-by-human label (anti-bot gate)
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const labels = context.payload.pull_request.labels.map(l => l.name);
+            if (!labels.includes('approved-by-human')) {
+              core.setFailed(
+                'PR requires the "approved-by-human" label applied by a human reviewer. ' +
+                'See 03-human-approval.yml — a bot approval does not satisfy this check.'
+              );
+            }
+<% } %>
+<% if (language === 'typescript' && locals.enableNativeBakeE2E) { %>  generated-gate-min:
+    name: Generated-gate min cell (TS, the gate-thesis on every PR)
+    # B5 (arbiter audit, gate-thesis reliability): arbiter's core promise —
+    # `arbiter init` on a project → the GENERATED project's own gate is green out
+    # of the box — was proven only nightly (generated-gate-e2e in _nightly.yml,
+    # VITEST_L2=1) or weekly (generator-matrix.yml). A regression in that promise
+    # could land on main and ride unnoticed for up to 24h. This is the minimal,
+    # fast slice of that same proof (ts-backend-web-db + ts-library — the two
+    # TypeScript functional-tier fixtures, ~25-30s locally) promoted to a
+    # PR-required check so the thesis is verified on every merge, not just at
+    # night. The other 4 languages' cells stay nightly-only (their toolchain
+    # install cost does not belong on the always-path of every PR). Self-only
+    # (enableNativeBakeE2E): downstream-generated projects do not ship arbiter's
+    # own __tests__/fixtures/real-projects/ harness, so this never renders for them.
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 15
+    needs: [gate<% if (locals.ciPreTestBuild) { %>, build-workspace<% } %><% if(governanceLevel !== 'L1' || _multiLane){ %>, classify-changes<% } %>]
+<% if(governanceLevel !== 'L1' || _multiLane){ %>    if: needs.classify-changes.outputs.docs_only != 'true'
+<% } %>    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: ./.github/actions/setup-node-pnpm
+<% if (locals.ciPreTestBuild) { %>      - name: Restore cached workspace build (non-blocking)
+        uses: ./.github/actions/build-cache
+        with:
+          op: restore
+      - run: node scripts/build-kit.mjs
+<% } %>      - name: Generated-gate e2e — TypeScript cell (VITEST_L2=1)
+        env:
+          VITEST_L2: "1"
+        run: |
+          npx vitest run --config vitest.integration.config.ts \
+            __tests__/integration/e2e/functional/fixture-functional.test.ts \
+            -t typescript
+
+<% } %>  ci-required:
+    name: CI Required
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+<%
+  const _ciNeeds = ['gate'];
+  if (_humanApproval) _ciNeeds.push('human-approval-required');
+  if (language === 'java' && buildTool === 'maven') _ciNeeds.push('build-reactor');
+  // #1875: contract-tests/integration-tests/behavioral-tests moved to the T2
+  // (02-pr-extended) conditional lane — only unit-tests stays on the always-run
+  // T1 path.
+  if ((language === 'typescript' || language === 'java') && !locals.enableNativeBakeE2E) {
+    _ciNeeds.push('unit-tests');
+  }
+  if (language === 'typescript' && locals.enableNativeBakeE2E) _ciNeeds.push('generated-gate-min');
+  // #1512: the per-PR ArchUnit (*ArchTest) lane is a BLOCKING required check for Java L2+.
+  if (language === 'java' && governanceLevel !== 'L1') _ciNeeds.push('archunit-tests');
+  if (enableSecurityScanning) _ciNeeds.push('security-early-fail', 'dependency-review');
+  if (governanceLevel !== 'L1' || _multiLane) _ciNeeds.push('iac-scan');
+  if (governanceLevel !== 'L1') _ciNeeds.push('docs-check', 'sonar-scan', 'gate-full');
+  if (enableDebtGates) _ciNeeds.push('debt-gates');
+  if (contractType && contractType !== 'none' && governanceLevel !== 'L1') _ciNeeds.push('contract-verify');
+  if (governanceLevel !== 'L1' || _multiLane) _ciNeeds.push('classify-changes');
+  if (_multiLane) _ciNeeds.push('cross-stack-guard');
+%>
+<%
+  // #1296 — docs-only PRs SKIP the code jobs (classify-changes gating); the
+  // aggregator accepts `skipped` for those jobs ONLY under docs_only=true, and
+  // requires the classification itself to have succeeded (fail-closed).
+  const _hasClassify = (governanceLevel !== 'L1' || _multiLane);
+%>    needs: [<%= _ciNeeds.join(', ') %>]
+    if: always()
+    steps:
+<% if (_hasClassify) { %>      - env:
+          DOCS_ONLY: ${{ needs.classify-changes.outputs.docs_only }}
+        run: |
+<% } else { %>      - run: |
+<% } %>
+<% if (_hasClassify) { %>          if [[ "${{ needs.classify-changes.result }}" != "success" ]]; then
+            echo "classify-changes failed — cannot trust docs_only, failing closed"
+            exit 1
+          fi
+          # success, or skipped ONLY when the docs-only classification skipped the job
+          ok() { [[ "$1" == "success" || ( "$DOCS_ONLY" == "true" && "$1" == "skipped" ) ]]; }
+<% } else { %>          ok() { [[ "$1" == "success" ]]; }
+<% } %>          if ! ok "${{ needs.gate.result }}"; then
+            echo "gate failed"
+            exit 1
+          fi
+<% if (language === 'java' && buildTool === 'maven') { %>
+          if ! ok "${{ needs.build-reactor.result }}"; then
+            echo "build-reactor failed"
+            exit 1
+          fi
+<% } if ((language === 'typescript' || language === 'java') && !locals.enableNativeBakeE2E) { %>
+          if ! ok "${{ needs.unit-tests.result }}"; then
+            echo "unit-tests failed"
+            exit 1
+          fi
+<% } %><% if (language === 'typescript' && locals.enableNativeBakeE2E) { %>
+          if ! ok "${{ needs.generated-gate-min.result }}"; then
+            echo "generated-gate-min failed — the generated-project gate-thesis cell is red"
+            exit 1
+          fi
+<% } %><% if (language === 'java' && governanceLevel !== 'L1') { %>
+          if ! ok "${{ needs.archunit-tests.result }}"; then
+            echo "archunit-tests failed"
+            exit 1
+          fi
+<% } %><% if (enableSecurityScanning) { %>
+          if [[ "${{ needs.security-early-fail.result }}" != "success" ]]; then
+            echo "security-early-fail failed"
+            exit 1
+          fi
+          # dependency-review skips on push (PR-only) — only a real finding blocks.
+          if [[ "${{ needs.dependency-review.result }}" == "failure" ]]; then
+            echo "dependency-review failed — a newly-introduced dependency exceeds the severity floor"
+            exit 1
+          fi<% } %><% if (_hasClassify) { %>
+          # iac-scan skips when no infra changed — only a real IaC finding blocks.
+          if [[ "${{ needs.iac-scan.result }}" == "failure" ]]; then
+            echo "iac-scan failed — an infrastructure-as-code misconfiguration was found"
+            exit 1
+          fi<% } %><% if (governanceLevel !== 'L1') { %>
+          if [[ "${{ needs.docs-check.result }}" == "failure" ]]; then
+            echo "docs-check failed"
+            exit 1
+          fi
+          if [[ "${{ needs.sonar-scan.result }}" == "failure" ]]; then
+            echo "sonar-scan failed"
+            exit 1
+          fi<% } %><% if (enableDebtGates) { %>
+          if ! ok "${{ needs.debt-gates.result }}"; then
+            echo "debt-gates failed"
+            exit 1
+          fi
+<% } %><% if (governanceLevel !== 'L1') { %>
+          if [[ "${{ needs.gate-full.result }}" != "success" && "${{ needs.gate-full.result }}" != "skipped" ]]; then
+            echo "gate-full (L2) failed or was cancelled"
+            exit 1
+          fi<% } %><% if (contractType && contractType !== 'none' && governanceLevel !== 'L1') { %>
+          if ! ok "${{ needs.contract-verify.result }}"; then
+            echo "contract-verify failed"
+            exit 1
+          fi<% } %><% if (_multiLane) { %>
+          if [[ "${{ needs.cross-stack-guard.result }}" == "failure" ]]; then
+            echo "cross-stack-guard failed"
+            exit 1
+          fi<% } %>
+<% if (_humanApproval) { %>          if [[ "${{ needs.human-approval-required.result }}" == "failure" ]]; then
+            echo "human-approval-required failed — PR needs approved-by-human label"
+            exit 1
+          fi
+<% } %>
+<% if (governanceLevel !== 'L1') { %>
+  post-merge-gate:
+    name: D4-LITE post-merge gate (main)
+    needs: [classify-changes, gate-full]
+    if: >
+      always() &&
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/main' &&
+      needs.classify-changes.result == 'success' &&
+      needs.classify-changes.outputs.docs_only != 'true'
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - name: Verify Full Gate outcome
+        env:
+          GATE_FULL_RESULT: ${{ needs.gate-full.result }}
+        run: |
+          if [[ "$GATE_FULL_RESULT" == "success" ]]; then
+            exit 0
+          fi
+          echo "Full Gate result was $GATE_FULL_RESULT; D4 fails closed." >&2
+          exit 1
+
+  post-merge-notify:
+    name: D4-LITE notify on failure
+    needs: [post-merge-gate]
+    if: always() && needs.post-merge-gate.result == 'failure'
+    permissions:
+      issues: write
+    uses: ./.github/workflows/_notify.yml
+    with:
+      workflow_name: D4-LITE post-merge gate
+      area: ci
+      severity: P1
+      branch: main
+      run_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      failure_summary: Post-merge L2 gate failed on main — a change merged without full verification.
+      status: failure
+<% } %><% } -%>