From 0e2dc86b535cbf4e91fd2a779e06ea3aaf149773 Mon Sep 17 00:00:00 2001
From: Mike Odnis <airwolf635@gmail.com>
Date: Fri, 17 Apr 2026 01:16:09 -0400
Subject: [PATCH 1/3] ci: add placeholder `required` status gate alongside
 existing CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Satisfies the `required` status-check context in org ruleset
`default-branch-baseline` (id 15191038, evaluate mode). Placeholder
that always passes; this repo'\''s existing CI workflows continue to
run independently.

Before the ruleset flips to active, harden this job with `needs:`
on the existing CI jobs — or swap for a call to a reusable workflow
in resq-software/.github.
---
 .github/workflows/required.yml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 .github/workflows/required.yml

diff --git a/.github/workflows/required.yml b/.github/workflows/required.yml
new file mode 100644
index 0000000..9a8b9fe
--- /dev/null
+++ b/.github/workflows/required.yml
@@ -0,0 +1,30 @@
+# Copyright 2026 ResQ Software
+# SPDX-License-Identifier: Apache-2.0
+#
+# Minimal `required` status-check emitter — complements the existing
+# CI workflow(s) in this repo. Placeholder that always passes so the
+# org ruleset `default-branch-baseline` (id 15191038) has the
+# `required` context to match against. Before the ruleset flips to
+# active, add `needs:` on the existing CI jobs (or swap for a reusable
+# workflow call from resq-software/.github).
+
+name: required
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  required:
+    name: required
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "ok — existing CI jobs run independently; harden before ruleset activation"

From 66c1e6caa16b9c582fdce74f449583ab58ccf667 Mon Sep 17 00:00:00 2001
From: Mike Odnis <airwolf635@gmail.com>
Date: Fri, 17 Apr 2026 01:24:04 -0400
Subject: [PATCH 2/3] ci: harden to cpp-ci reusable; remove inline ci.yml +
 placeholder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the previous inline cmake/ctest matrix and the placeholder
required.yml with a single ci.yml that calls the org-wide `required`
aggregator with `lang: cpp` and the correct source-dir +
cmake-flags preserved from the prior workflow.

Pinned to resq-software/.github@6410acba18c9fc79949643abd48f0a2d43994c62 (the commit introducing
cpp-ci.yml). Re-pin to the merge commit or tag after PR#12 lands.

Parity:
- os matrix: ubuntu + macos + windows (same as before)
- source: packages/resq-common (same)
- flag:   -DRESQ_COMMON_BUILD_TESTS=ON (same)

Additionally runs CodeQL for c-cpp and the full security-scan
suite via the reusable — upgrade from the prior CI.
---
 .github/workflows/ci.yml       | 56 ++++++++++++++++++++++++----------
 .github/workflows/required.yml | 30 ------------------
 2 files changed, 40 insertions(+), 46 deletions(-)
 delete mode 100644 .github/workflows/required.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ba86ea..76f070f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,27 +1,51 @@
+# Copyright 2026 ResQ Software
+# SPDX-License-Identifier: Apache-2.0
+#
+# Thin CI wrapper. Dispatches to the org-wide reusable `required`
+# aggregator (which calls cpp-ci matrix + security-scan). Subsumes
+# the prior inline cmake/ctest workflow AND the placeholder
+# required.yml — both removed in the same PR.
+
 name: CI
 
 on:
   push:
     branches: [main]
-    paths: ["packages/**"]
+    paths: ["packages/**", ".github/workflows/ci.yml"]
   pull_request:
     branches: [main]
 
-jobs:
-  test:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: read
 
-      - name: Configure
-        run: cmake -B build -DRESQ_COMMON_BUILD_TESTS=ON packages/resq-common
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-      - name: Build
-        run: cmake --build build --config Debug
+jobs:
+  gates:
+    uses: resq-software/.github/.github/workflows/required.yml@6410acba18c9fc79949643abd48f0a2d43994c62
+    with:
+      lang: cpp
+      cpp-os-list: '["ubuntu-latest","macos-latest","windows-latest"]'
+      cpp-source-dir: "packages/resq-common"
+      cpp-cmake-flags: "-DRESQ_COMMON_BUILD_TESTS=ON"
+      codeql-languages: '["c-cpp"]'
+    secrets: inherit
 
-      - name: Test
-        run: ctest --test-dir build --output-on-failure -C Debug
+  required:
+    name: required
+    runs-on: ubuntu-latest
+    needs: [gates]
+    if: always()
+    steps:
+      - env:
+          R: ${{ needs.gates.result }}
+        run: |
+          set -eu
+          case "$R" in
+            success|skipped|"") echo "ok: gates=$R" ;;
+            *) echo "::error::gates reusable returned: $R"; exit 1 ;;
+          esac
diff --git a/.github/workflows/required.yml b/.github/workflows/required.yml
deleted file mode 100644
index 9a8b9fe..0000000
--- a/.github/workflows/required.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-# Copyright 2026 ResQ Software
-# SPDX-License-Identifier: Apache-2.0
-#
-# Minimal `required` status-check emitter — complements the existing
-# CI workflow(s) in this repo. Placeholder that always passes so the
-# org ruleset `default-branch-baseline` (id 15191038) has the
-# `required` context to match against. Before the ruleset flips to
-# active, add `needs:` on the existing CI jobs (or swap for a reusable
-# workflow call from resq-software/.github).
-
-name: required
-
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  required:
-    name: required
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "ok — existing CI jobs run independently; harden before ruleset activation"

From a86687d696a08bab90a893f739d6e3b8b23d6a76 Mon Sep 17 00:00:00 2001
From: Mike Odnis <airwolf635@gmail.com>
Date: Fri, 17 Apr 2026 06:12:03 -0400
Subject: [PATCH 3/3] ci: re-pin reusable workflow ref to resq-software/.github
 main
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Updates @SHA from the feat-branch tip to the merge commit of
resq-software/.github#12 (f4b51a620aa1bf89c0bce4f434b36f92ff7d517d). Functionally equivalent — same
content — but pins to a ref that now exists on main rather than a
closed PR branch.
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76f070f..6b39cca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ concurrency:
 
 jobs:
   gates:
-    uses: resq-software/.github/.github/workflows/required.yml@6410acba18c9fc79949643abd48f0a2d43994c62
+    uses: resq-software/.github/.github/workflows/required.yml@f4b51a620aa1bf89c0bce4f434b36f92ff7d517d
     with:
       lang: cpp
       cpp-os-list: '["ubuntu-latest","macos-latest","windows-latest"]'