ci: route PR checks by risk with trusted Required Gate (phase 3)

.github/PULL_REQUEST_TEMPLATE.md

@@ -9,7 +9,7 @@
 - 未执行及原因：<!-- 包括完整检查、部署形态或发布验收 -->
 - 最新提交的远程合并门禁：<!-- 提交 SHA、必需检查结果；尚未运行时注明 -->
 - [ ] 本地定向验证已记录；未将其表述为 CI 或发布验收完成
-- [ ] 合并前使用适用的 `ci:light` 或 `ci:milestone`；代码和开发规则改动不用 `ci:light`
+- [ ] 核对自动选择的 PR 检查及当前提交的 `Required Gate`；需要完整验收时使用 `ci:milestone`，CI 治理变更走 Bootstrap
 
 ## 风险与后续
 

.github/workflows/backend-ci.yml

@@ -1,54 +1,14 @@
 name: Backend CI
 
 on:
-  pull_request:
-    types: [labeled]
-    paths:
-      - "backend/**"
-      - "skills/**"
-      - "scripts/smoke_s3.py"
-      - "scripts/smoke_s4.py"
-      - "scripts/smoke_s5.py"
-      - "scripts/smoke_s6.py"
-      - "scripts/smoke_s7.py"
-      - "scripts/smoke_s8.py"
-      - "scripts/smoke_s9.py"
-      - "scripts/smoke_s10.py"
-      - "scripts/smoke_s11.py"
-      - "scripts/smoke_s18.py"
-      - "scripts/smoke_s19.py"
-      - "scripts/smoke_s21.py"
-      - "scripts/smoke_s22.py"
-      - "scripts/smoke_s23.py"
-      - "scripts/smoke_s24.py"
-      - "scripts/smoke_s25.py"
-      - "scripts/smoke_s26.py"
-      - "scripts/smoke_s27.py"
-      - "scripts/smoke_s28.py"
-      - "scripts/smoke_s29.py"
-      - "scripts/smoke_s30.py"
-      - "scripts/smoke_s47.py"
-      - "scripts/verify_s47_2_contract_migration.py"
-      - "scripts/verify_s47_3_contract_migration.py"
-      - "scripts/verify_kafka_compat.py"
-      - "scripts/storage_transfer.py"
-      - "scripts/capacity_s11.py"
-      - "scripts/capacity_workflow.py"
-      - "scripts/capacity_s19.py"
-      - "scripts/capacity_s29.py"
-      - ".github/workflows/backend-ci.yml"
+  workflow_call:
   workflow_dispatch:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
 jobs:
   test:
-    if: ${{ github.event_name != 'pull_request' || github.event.label.name == 'ci:milestone' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -73,12 +33,7 @@ jobs:
       - name: Test
         working-directory: backend
         run: uv run pytest
-      - name: Dependency audit
-        working-directory: backend
-        run: uv run pip-audit
-
   integration:
-    if: ${{ github.event_name != 'pull_request' || github.event.label.name == 'ci:milestone' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

.github/workflows/ci-bootstrap-validation.yml

@@ -0,0 +1,45 @@
+name: CI Bootstrap Validation
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - "AGENTS.md"
+      - "CONTRIBUTING.md"
+      - "Makefile"
+      - ".github/PULL_REQUEST_TEMPLATE.md"
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - "docs/ci-milestone.md"
+      - "docs/development-efficiency-phase3.md"
+      - "backend/tests/test_ci_plan.py"
+      - "backend/tests/test_required_gate.py"
+      - "scripts/build_skill_evaluation.py"
+      - "scripts/ci_plan.py"
+      - "scripts/ci_summary.py"
+      - "scripts/required_gate.py"
+      - "scripts/run_targeted_tests.py"
+
+# Governance changes cannot pass the normal Required Gate. This separate,
+# PR-triggered full suite supplies eligible checks for maintainer Bootstrap.
+# It never publishes the Required Gate status or changes the branch ruleset.
+permissions:
+  contents: read
+
+jobs:
+  bootstrap-quick:
+    uses: ./.github/workflows/quick-ci.yml
+  bootstrap-backend:
+    uses: ./.github/workflows/backend-ci.yml
+  bootstrap-frontend:
+    uses: ./.github/workflows/frontend-ci.yml
+  bootstrap-compose:
+    uses: ./.github/workflows/compose-ci.yml
+  bootstrap-security:
+    uses: ./.github/workflows/security-ci.yml
+  bootstrap-windows:
+    uses: ./.github/workflows/standalone-windows.yml
+  bootstrap-upgrade:
+    uses: ./.github/workflows/upgrade-ci.yml
+  bootstrap-skills:
+    uses: ./.github/workflows/skills-ci.yml

.github/workflows/compose-ci.yml

@@ -1,49 +1,7 @@
 name: Compose Smoke Test
 
 on:
-  pull_request:
-    types: [labeled]
-    paths:
-      - "backend/**"
-      - "frontend/**"
-      - "mock-target/**"
-      - "compose.yaml"
-      - "deploy/compact/**"
-      - "deploy/compatibility/**"
-      - "deploy/s47/**"
-      - "scripts/smoke_s3.py"
-      - "scripts/smoke_s4.py"
-      - "scripts/smoke_s5.py"
-      - "scripts/smoke_s6.py"
-      - "scripts/smoke_s7.py"
-      - "scripts/smoke_s8.py"
-      - "scripts/smoke_s9.py"
-      - "scripts/smoke_s10.py"
-      - "scripts/smoke_s11.py"
-      - "scripts/smoke_s18.py"
-      - "scripts/smoke_s19.py"
-      - "scripts/smoke_s21.py"
-      - "scripts/smoke_s22.py"
-      - "scripts/smoke_s23.py"
-      - "scripts/smoke_s24.py"
-      - "scripts/smoke_s25.py"
-      - "scripts/smoke_s26.py"
-      - "scripts/smoke_s27.py"
-      - "scripts/smoke_s28.py"
-      - "scripts/smoke_s29.py"
-      - "scripts/smoke_s30.py"
-      - "scripts/smoke_s31.py"
-      - "scripts/smoke_s32.py"
-      - "scripts/smoke_s47.py"
-      - "scripts/verify_kafka_compat.py"
-      - "scripts/storage_transfer.py"
-      - "scripts/capacity_s11.py"
-      - "scripts/capacity_workflow.py"
-      - "scripts/capacity_s19.py"
-      - "scripts/capacity_s29.py"
-      - "scripts/backup.sh"
-      - "scripts/verify_restore.sh"
-      - ".github/workflows/compose-ci.yml"
+  workflow_call:
   workflow_dispatch:
     inputs:
       run_rc_gates:
@@ -52,10 +10,6 @@ on:
         default: false
         type: boolean
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
@@ -219,7 +173,6 @@ jobs:
         run: docker compose --env-file deploy/compact/.env -f deploy/compact/compose.yaml down --volumes
 
   smoke:
-    if: ${{ github.event_name != 'pull_request' || github.event.label.name == 'ci:milestone' }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     env:

.github/workflows/frontend-ci.yml

@@ -1,23 +1,14 @@
 name: Frontend CI
 
 on:
-  pull_request:
-    types: [labeled]
-    paths:
-      - "frontend/**"
-      - ".github/workflows/frontend-ci.yml"
+  workflow_call:
   workflow_dispatch:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
 jobs:
   build:
-    if: ${{ github.event_name != 'pull_request' || github.event.label.name == 'ci:milestone' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -41,6 +32,3 @@ jobs:
       - name: Build
         working-directory: frontend
         run: pnpm build
-      - name: Dependency audit
-        working-directory: frontend
-        run: pnpm audit --audit-level high

.github/workflows/full-regression.yml

@@ -0,0 +1,29 @@
+name: Full Regression
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: full-regression-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  backend:
+    uses: ./.github/workflows/backend-ci.yml
+  frontend:
+    uses: ./.github/workflows/frontend-ci.yml
+  compose:
+    uses: ./.github/workflows/compose-ci.yml
+  security:
+    uses: ./.github/workflows/security-ci.yml
+  windows:
+    uses: ./.github/workflows/standalone-windows.yml
+  upgrade:
+    uses: ./.github/workflows/upgrade-ci.yml
+  skills:
+    uses: ./.github/workflows/skills-ci.yml