.github/workflows/ci.yml

@@ -3,7 +3,7 @@
 # Build bar: `dotnet build gclo.slnx -p:Platform=x64` must produce ZERO warnings,
 # which -warnaserror enforces (this also fails the build on NuGetAudit
 # vulnerability warnings, so known-vulnerable packages break CI).
-name: CI
+name: ci
 
 on:
   push:
@@ -32,7 +32,7 @@ concurrency:
 
 jobs:
   build-test:
-    name: Build and test (x64)
+    name: build-test
     runs-on: windows-latest
     timeout-minutes: 30
     steps:
@@ -116,7 +116,7 @@ jobs:
     # (the Release workflow) can make it advisory so a flaky UI run cannot block
     # an immutable tag that main itself would have accepted. On push/PR events the
     # input is unset, so the job fails the workflow exactly as before.
-    name: UI end-to-end tests (x64)
+    name: ui-tests
     runs-on: windows-latest
     timeout-minutes: 30
     continue-on-error: ${{ inputs.ui-tests-advisory == true }}
@@ -155,7 +155,7 @@ jobs:
           if-no-files-found: warn
 
   format:
-    name: Format (style gate)
+    name: format
     runs-on: windows-latest
     timeout-minutes: 20
     steps:

.github/workflows/dependency-review.yml

@@ -1,69 +0,0 @@
-# Superseded by pr-gates.yml (`pr / dependency-review`, K22-CI-01); kept only
-# until the protect-main ruleset lists the new required contexts (#66), then
-# removed.
-#
-# Blocks pull requests that add dependencies with known vulnerabilities or with
-# licenses outside the allowlist below. Only dependencies *added or changed* by
-# the PR are checked (via the GitHub dependency graph diff), so existing
-# dependencies never retroactively fail this gate.
-name: Dependency Review
-
-on:
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    name: Dependency review
-    # No build happens here, so the cheaper Linux runner is fine.
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      # Needed for comment-summary-in-pr.
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Dependency review
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
-        with:
-          # Fail on ANY known vulnerability, even low severity.
-          fail-on-severity: low
-          comment-summary-in-pr: on-failure
-          # Anything not on this list fails the check. This repo is MIT, so we
-          # accept permissive licenses plus GPL-2.0 "with linking exception"
-          # style grants (e.g. libgit2's license). Extend deliberately - a new
-          # license here is a legal decision, not a build fix.
-          allow-licenses: >-
-            MIT,
-            MIT-0,
-            Apache-2.0,
-            BSD-2-Clause,
-            BSD-3-Clause,
-            0BSD,
-            ISC,
-            MS-PL,
-            Unlicense,
-            CC0-1.0,
-            GPL-2.0-only WITH Classpath-exception-2.0,
-            GPL-2.0-or-later WITH Classpath-exception-2.0,
-            GPL-2.0-only WITH GCC-exception-2.0
-          # Packages whose nuspec declares the license as a FILE rather than an
-          # SPDX expression, which the dependency graph reports as "unknown" /
-          # NOASSERTION and would otherwise fail every version bump. All three have
-          # shipped in gclo since the first commit, so this is not a new license
-          # decision - it records what they actually are:
-          #   LibGit2Sharp                     MIT (App_Readme/LICENSE.md)
-          #   Microsoft.WindowsAppSDK          Microsoft Software License Terms (license.txt)
-          #   Microsoft.Windows.SDK.BuildTools Windows SDK license (aka.ms/WinSDKLicenseURL)
-          # Vulnerability scanning still applies to them; only the license check is skipped.
-          allow-dependencies-licenses: >-
-            pkg:nuget/LibGit2Sharp,
-            pkg:nuget/Microsoft.WindowsAppSDK,
-            pkg:nuget/Microsoft.Windows.SDK.BuildTools

docs/RELEASING.md

@@ -134,7 +134,7 @@ Both install the same asset, `gclo-cli-win-x64.zip`, by URL and SHA-256.
    - **Verify tag** — validate the tag, derive version/channel, and check
      that the tagged commit is contained in `main`. A tag on any other commit
      fails here and nothing is built or published.
-   - **Gates** — the full `CI` workflow, exactly as a pull request runs it:
+   - **Gates** — the full `ci` workflow, exactly as a pull request runs it:
      x64 build with warnings as errors, 100% line coverage on
      `gclo.Engine` / `gclo.ViewModels` / `gclo`, and the formatting gate.
      The FlaUI UI smoke suite runs as well but is **advisory** for a release,