Separate fork CI from upstream mirror workflows

.github/workflows/ci.yml → .github/workflows/fork-ci.yml

@@ -1,4 +1,4 @@
-name: CI
+name: Fork CI
 
 env:
   # Install dependencies without downloading Electron in every job. The desktop jobs
@@ -8,9 +8,6 @@ env:
 on:
   workflow_dispatch:
   pull_request:
-  push:
-    branches:
-      - main
 
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}

.github/workflows/rebase-pr-stack.yml

@@ -57,4 +57,4 @@ jobs:
       - name: Dispatch integration CI
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref fork/integration
+        run: gh workflow run fork-ci.yml --repo "$GITHUB_REPOSITORY" --ref fork/integration

AGENTS.md

@@ -35,6 +35,10 @@ branches.
 - The stack workflow runs every six hours and may be dispatched manually to mirror
   `pingdotgg/t3code:main`. Its deploy key is the only automation bypass for protected `main`; agents
   must never print, replace, or reuse that credential outside this workflow.
+- Fork checks live in `.github/workflows/fork-ci.yml` and run for PRs or by explicit integration
+  dispatch. The inherited upstream `.github/workflows/ci.yml` and `deploy-relay.yml` workflows are
+  disabled at repository level so mirror updates do not run redundant CI or attempt upstream relay
+  deployment. Do not re-enable or target those workflows for fork releases.
 - Updating `fork/tim` or merging a PR into `fork/changes` triggers the stack workflow, which rebases
   the provenance layers, rebuilds `fork/integration`, and dispatches CI for its exact SHA.
 - Successful `fork/integration` CI hands the exact tested SHA to the private operations repository.

docs/fork-stack.md

@@ -35,6 +35,12 @@ force-with-lease. A repository-scoped write deploy key stored as `FORK_STACK_DEP
 automation actor allowed to bypass `main`'s PR and status-check requirements. It cannot access other
 repositories. Never expose or reuse it.
 
+Upstream's `.github/workflows/ci.yml` and `.github/workflows/deploy-relay.yml` remain present on the
+exact `main` mirror but are disabled in this repository. Fork PR and integration checks use
+`.github/workflows/fork-ci.yml`; the stack workflow dispatches that workflow for the exact generated
+integration SHA. This avoids redundant CI and prevents an upstream-mirror update from being treated
+as a fork product or relay deployment.
+
 ## Starting work
 
 The helper starts an independent branch from `fork/changes`:

docs/operations/ci.md

@@ -1,6 +1,8 @@
 # CI quality gates
 
-- `.github/workflows/ci.yml` runs `vp check` (lint + typecheck), `vpr typecheck`, and `vp run test` on pull requests and pushes to `main`.
+- `.github/workflows/fork-ci.yml` runs the fork quality gates for pull requests and for exact
+  `fork/integration` SHAs dispatched by the stack workflow. The inherited upstream `ci.yml` workflow
+  is disabled so updates to the exact `main` mirror do not duplicate those checks.
 - `.github/workflows/release.yml` builds macOS (`arm64` and `x64`), Linux (`x64`), and Windows (`x64`) desktop artifacts from a single `v*.*.*` tag and publishes one GitHub release.
 - The release workflow auto-enables signing only when platform credentials are present. macOS passkey builds additionally require `APPLE_TEAM_ID` and the `MACOS_PROVISIONING_PROFILE` secret; Windows uses Azure Trusted Signing. Without the core signing credentials, it still releases unsigned artifacts.
 - See [Release Checklist](./release.md) for the full release/signing setup checklist.