Run the full validation pipeline on pull requests

.github/workflows/_security.yml

@@ -46,7 +46,9 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          CURRENT_SHA="${{ github.sha }}"
+          # On pull_request events github.sha is the synthetic merge commit;
+          # CodeQL runs are recorded against the PR head SHA.
+          CURRENT_SHA="${{ github.event.pull_request.head.sha || github.sha }}"
           echo "Waiting for CodeQL to complete on $CURRENT_SHA..."
           for attempt in $(seq 1 90); do
             LATEST=$(gh api repos/${{ github.repository }}/actions/workflows/codeql.yml/runs?per_page=5 \

.github/workflows/codeql.yml

@@ -3,6 +3,8 @@ name: CodeQL SAST
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
 
 permissions:
   security-events: write

.github/workflows/pr.yml

@@ -0,0 +1,51 @@
+# PR validation: security gates + lint + full test suite. Builds, smoke and
+# soak stay maintainer-driven via the dry-run workflow_dispatch. Branch
+# protection requires `dco` + `ci-ok` — a single stable summary context that
+# fails unless every PR stage succeeded.
+name: PR
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    uses: ./.github/workflows/_security.yml
+    secrets: inherit
+
+  lint:
+    uses: ./.github/workflows/_lint.yml
+
+  test:
+    needs: [lint]
+    if: ${{ !cancelled() && needs.lint.result == 'success' }}
+    uses: ./.github/workflows/_test.yml
+    with:
+      # Perf assertions are timing-sensitive on shared runners; they stay in
+      # dry runs and releases where a flaky red does not block a merge.
+      skip_perf: true
+
+  ci-ok:
+    # The one required context (besides dco) — fails unless every PR stage
+    # succeeded, so matrix renames can never silently deadlock merges.
+    needs: [security, lint, test]
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: All PR stages must have succeeded
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          echo "$RESULTS" | python3 -c "
+          import json, sys
+          needs = json.load(sys.stdin)
+          bad = {k: v['result'] for k, v in needs.items() if v['result'] != 'success'}
+          if bad:
+              print('CI NOT OK:', bad)
+              sys.exit(1)
+          print('CI OK:', ', '.join(needs))
+          "

scripts/license-policy.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "License allow-list for the CI license gate (scripts/license-gate.sh). A single detected SPDX id outside this list fails the pipeline. Additions to this list are deliberate, reviewed changes — never add copyleft (GPL/LGPL/AGPL/EPL/SSPL) without a maintainer decision.",
+  "_comment": "License allow-list for the CI license gate (scripts/license-gate.sh). A single detected SPDX id outside this list fails the pipeline. Additions to this list are deliberate, reviewed changes \u2014 never add copyleft (GPL/LGPL/AGPL/EPL/SSPL) without a maintainer decision.",
   "allowed_spdx_ids": [
     "MIT",
     "MIT-0",
@@ -16,12 +16,13 @@
     "LicenseRef-scancode-public-domain",
     "LicenseRef-scancode-public-domain-disclaimer"
   ],
-  "_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references.",
+  "_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references.",
   "ignored_paths": [
     "tree/scripts/license-policy.json",
     "tree/scripts/license-gate-check.py",
     "tree/scripts/license-gate.sh",
     "tree/scripts/gen-third-party-notices.sh",
-    "tree/src/discover/discover.c"
+    "tree/src/discover/discover.c",
+    "tree/scripts/audit-license-provenance.py"
   ]
 }