Move automatic CI and tests entirely to Jenkins

.github/CI_POLICY.md

@@ -0,0 +1,25 @@
+# GitHub Actions policy — Jenkins is the CI authority
+
+This fork deliberately delegates automatic builds, tests, lint, security audits,
+soak tests, benchmarks, and release qualification to **Jenkins**.
+
+GitHub-hosted workflows must use **only** `workflow_dispatch` (operator-initiated)
+or `workflow_call` (reusable by a manually dispatched workflow) as events.
+No `push`, `pull_request`, `pull_request_target`, `schedule`, `issues`,
+`workflow_run`, or other automatic Actions events are allowed.
+
+* Jenkins' `Jenkinsfile` runs `scripts/ci/check-github-actions-policy.py`.
+* The GitHub release/promotion workflows are retained as **manual-only**
+  fallback/publishing operations. They can consume Actions minutes when started.
+* CodeQL, GitHub Pages, smoke/soak and repro workflows remain manual-only;
+  GitHub Pages will **not** update automatically after merges.
+* The cost-intensive PR matrix and weekly test-impact artifact producer have
+  been removed. Use Jenkins for automatic PR checks and qualification evidence.
+* Upstream merges may reintroduce workflows: adapt or remove their triggers
+  before accepting a synchronization PR. This policy is part of the release gate.
+* No GitHub Actions workflow should be used for automatic upstream synchronization.
+  Monitoring may be external; any proposed integration remains a reviewable PR.
+
+To eliminate even manual GitHub Actions usage, disable Actions in the repository's
+**Settings → Actions → General**; that also disables the manual release and
+Pages deployment workflows.

.github/workflows/codeql.yml

@@ -1,10 +1,9 @@
 name: CodeQL SAST
 
+# Security scanning is available only on explicit operator request.
+# Jenkins owns automatic builds, tests and security checks.
 on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read

.github/workflows/fast-repro.yml

@@ -3,7 +3,7 @@
 # 5-platform ASan board. The full bug-repro.yml board remains the comprehensive
 # all-platform check; this is just the fast inner loop.
 #
-# Trigger: workflow_dispatch, or push to a qa/fast-** branch. Non-gating.
+# Trigger: manual workflow_dispatch only. Jenkins owns automated testing.
 name: Fast Repro
 
 on:
@@ -13,8 +13,6 @@ on:
         description: 'Comma list of suite-name substrings to run (empty = all)'
         type: string
         default: ''
-  push:
-    branches: ['qa/fast-**']
 
 permissions:
   contents: read

.github/workflows/nightly-soak.yml

@@ -1,16 +1,14 @@
-# Soak dispatcher — the weekly scheduled soak AND every on-demand soak run.
+# Soak dispatcher — explicitly requested runs only (no scheduled runs).
 #
 # Absorbs the retired soak.yml (the standalone "multi-hour #581" workflow): its
 # reasons to exist — a job budget that actually covers a 4h run, and the
 # query-leak mode that never reindexes so the #581 leak can accumulate — are
 # now _soak.yml facts (timeout 560, legs input). A long #581-only run is
 # `legs: query-leak` here, not a separate workflow with its own copy of the
-# soak procedure. NON-GATING: never a required check, never blocks a merge.
+# soak procedure. NON-GATING: manually dispatched only; Jenkins owns automated soak.
 name: Nightly Soak
 
 on:
-  schedule:
-    - cron: '0 2 * * 0' # Every Sunday at 2am UTC
   workflow_dispatch:
     inputs:
       duration_minutes:
@@ -26,10 +24,6 @@ on:
         description: 'Also run the 15-min ASan soak legs'
         type: boolean
         default: true
-  # Iteration convenience carried over from soak.yml: pushing a qa/soak-**
-  # branch starts a real run from that branch's own copy of the workflows.
-  push:
-    branches: ['qa/soak-**']
 
 permissions:
   contents: read
@@ -39,7 +33,7 @@ jobs:
   # budget instead of a fixed count. NON-GATING like the soak; a crash uploads
   # its reproducer, which becomes a fixed-seed regression input once fixed.
   fuzz:
-    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+    if: ${{ github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
@@ -59,8 +53,7 @@ jobs:
   soak:
     uses: ./.github/workflows/_soak.yml
     with:
-      # On schedule/push events the inputs context is empty — fall back to the
-      # weekly defaults (4h, both legs, ASan on).
+      # Values come only from manual workflow_dispatch input.
       duration_minutes: ${{ inputs.duration_minutes || 240 }}
       legs: ${{ inputs.legs || 'quick,query-leak' }}
-      run_asan: ${{ github.event_name != 'workflow_dispatch' || inputs.run_asan }}
+      run_asan: ${{ inputs.run_asan }}

.github/workflows/pages.yml

@@ -11,11 +11,6 @@
 name: Deploy Pages
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - 'docs/**'
-      - '.github/workflows/pages.yml'
   workflow_dispatch:
 
 permissions: