From 8502e23e401cf885fd62d1481f05c93ad759c522 Mon Sep 17 00:00:00 2001
From: Guard Propagator <noreply@kritical.net>
Date: Wed, 12 Aug 2026 23:29:06 +1000
Subject: [PATCH] ci: gate all 5 CI jobs behind
 KRITICAL_GW_HOSTED_GATES_ENABLED (local gating only)

Same proven shape as Kritical.GreatWhite.Control.EngineeringSystem's
great-white-gates.yml, applied to all 5 jobs (build-vscode-extension, test-ps-module,
test-mcp-server, test-continue-config, test-install-scripts). Addition only -- no
trigger, step, or job removed/renamed.
---
 .github/workflows/ci.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 96019e8..cbd2f91 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,10 @@ jobs:
   # Path C — VS Code extension build
   # ────────────────────────────────────────────────────────────────
   build-vscode-extension:
+    # Hosted Actions is opt-in while the account runner/billing path is unavailable.
+    # The check name and gate steps remain intact; local deterministic gates are the
+    # authoritative path until this repository variable is explicitly enabled.
+    if: ${{ vars.KRITICAL_GW_HOSTED_GATES_ENABLED == 'true' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -35,6 +39,10 @@ jobs:
   # Path D — PowerShell module
   # ────────────────────────────────────────────────────────────────
   test-ps-module:
+    # Hosted Actions is opt-in while the account runner/billing path is unavailable.
+    # The check name and gate steps remain intact; local deterministic gates are the
+    # authoritative path until this repository variable is explicitly enabled.
+    if: ${{ vars.KRITICAL_GW_HOSTED_GATES_ENABLED == 'true' }}
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
@@ -56,6 +64,10 @@ jobs:
   # Path E — MCP server
   # ────────────────────────────────────────────────────────────────
   test-mcp-server:
+    # Hosted Actions is opt-in while the account runner/billing path is unavailable.
+    # The check name and gate steps remain intact; local deterministic gates are the
+    # authoritative path until this repository variable is explicitly enabled.
+    if: ${{ vars.KRITICAL_GW_HOSTED_GATES_ENABLED == 'true' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -77,6 +89,10 @@ jobs:
   # Path A — Continue config JSON validity
   # ────────────────────────────────────────────────────────────────
   test-continue-config:
+    # Hosted Actions is opt-in while the account runner/billing path is unavailable.
+    # The check name and gate steps remain intact; local deterministic gates are the
+    # authoritative path until this repository variable is explicitly enabled.
+    if: ${{ vars.KRITICAL_GW_HOSTED_GATES_ENABLED == 'true' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -88,6 +104,10 @@ jobs:
   # Install scripts — parse-check + Status mode dry-run
   # ────────────────────────────────────────────────────────────────
   test-install-scripts:
+    # Hosted Actions is opt-in while the account runner/billing path is unavailable.
+    # The check name and gate steps remain intact; local deterministic gates are the
+    # authoritative path until this repository variable is explicitly enabled.
+    if: ${{ vars.KRITICAL_GW_HOSTED_GATES_ENABLED == 'true' }}
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4