Run the full validation pipeline on pull requests

Pull requests now execute the dry-run chain (security including the
license gates, lint, full test suite, all build legs, smoke) plus a
single ci-ok summary job that fails unless every stage succeeded.
Branch protection requires dco + ci-ok, so nothing unverified can merge
— including from admins. CodeQL also runs on pull requests so the
security island completes on PR commits.

Signed-off-by: Martin Vogel <martin.vogel@datadice.io>

Author: DeusData

.github/workflows/codeql.yml

@@ -3,6 +3,8 @@ name: CodeQL SAST
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
 
 permissions:
   security-events: write

.github/workflows/pr.yml

@@ -0,0 +1,61 @@
+# PR validation: the full dry-run pipeline (minus soak) on every pull
+# request. Branch protection requires the final `ci-ok` summary job — a
+# single stable context that fails unless every stage succeeded, so matrix
+# renames can never silently deadlock merges.
+name: PR
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    uses: ./.github/workflows/_security.yml
+    secrets: inherit
+
+  lint:
+    uses: ./.github/workflows/_lint.yml
+
+  test:
+    needs: [lint]
+    if: ${{ !cancelled() && needs.lint.result == 'success' }}
+    uses: ./.github/workflows/_test.yml
+    with:
+      # Perf assertions are timing-sensitive on shared runners; they stay in
+      # dry runs and releases where a flaky red does not block a merge.
+      skip_perf: true
+
+  build:
+    needs: [test]
+    if: ${{ !cancelled() && needs.test.result == 'success' }}
+    uses: ./.github/workflows/_build.yml
+
+  smoke:
+    needs: [build]
+    if: ${{ !cancelled() && needs.build.result == 'success' }}
+    uses: ./.github/workflows/_smoke.yml
+
+  ci-ok:
+    # The one required context (besides dco). Runs even when upstream jobs
+    # fail, and passes only when every stage succeeded.
+    needs: [security, lint, test, build, smoke]
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: All stages must have succeeded
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          echo "$RESULTS" | python3 -c "
+          import json, sys
+          needs = json.load(sys.stdin)
+          bad = {k: v['result'] for k, v in needs.items() if v['result'] != 'success'}
+          if bad:
+              print('CI NOT OK:', bad)
+              sys.exit(1)
+          print('CI OK:', ', '.join(needs))
+          "