[thedancingdeveloper]

WI-1886: CI cost. Same treatment vogt got on wi-1886-merge-queue. See docs/ci.md.

Changes (fork-ci.yml only; no upstream workflow is edited)

• merge_group trigger. In the queue, the changed-package diff runs against merge_group.base_sha, so it covers the whole queued group. cargo check --workspace still compiles everything.
• Path scope on PRs. A PR with nothing under codex-rs/ or .github/ skips the Rust steps. The job still reports fmt, clippy, test as passed, so a required check never waits on it.
• Concurrency. fork-ci-${{ github.ref }} with cancel-in-progress. A force-push cancels the superseded run, and queue refs are unique per entry.
• Docs. New docs/ci.md, plus a pointer in FORK.md § Workflows. The fork has no root AGENTS.md or CLAUDE.md, and README.md is upstream's, so I left those alone to keep upstream rebases conflict-free.
• Runners. merge_group runs on the self-hosted GCP rust-heavy runner. Only PRs from other forks use GitHub-hosted runners.

Deliberate difference from vogt: the queue is package-scoped, not a full run. A workspace-wide nextest takes about an hour, and upstream test debt makes it fail regardless of the PR. Rationale is in docs/ci.md.

Operator: ruleset to approve (not applied)

fork/main currently has no protection and no ruleset. POST repos/TheDancingDeveloper-org/codex/rulesets:

{"name":"fork/main merge queue","target":"branch","enforcement":"active",
 "bypass_actors":[{"actor_id":5,"actor_type":"RepositoryRole","bypass_mode":"always"}],
 "conditions":{"ref_name":{"include":["refs/heads/fork/main"],"exclude":[]}},
 "rules":[
  {"type":"required_status_checks","parameters":{"strict_required_status_checks_policy":false,"required_status_checks":[{"context":"fmt, clippy, test","integration_id":15368}]}},
  {"type":"merge_queue","parameters":{"merge_method":"MERGE","max_entries_to_build":2,"min_entries_to_merge":1,"max_entries_to_merge":3,"min_entries_to_merge_wait_minutes":5,"grouping_strategy":"ALLGREEN","check_response_timeout_minutes":90}}]}

• The admin bypass keeps the upstream-sync --force-with-lease rebase of fork/main possible. Drain the queue before a sync.
• MERGE matches how fork PRs land today (merge commits, e.g. Integration: drift check and upstream rust-v0.162.1 fixes (WI-1125) #33).

Not verified

• Not run in CI: the queue is off until the ruleset exists.
• Checked: actionlint on fork-ci.yml is clean.

Do not merge without operator approval.

🤖 Generated with Claude Code