revert: trunk-only CI gating (repo not in merge-train core set)

[kjgbot]

Reverts the trunk-only CI gating. This repo is not in the core merge-train set, so normal per-PR CI is restored.

🤖 Generated with Claude Code

---

Note

Low Risk
Workflow-only changes that widen when CI runs; no application or security logic is modified.

Overview
Reverts trunk-only CI and merge-train gating so this repo behaves like a normal GitHub flow again.

CI (ci.yml): Drops the if guards on lint, typecheck, test, and build that only ran those jobs on pushes or on PRs whose head branch was trunk. Those jobs now run on every PR (and push) to main. The ci-success summary job still uses always() but no longer skips non-trunk PRs.

Compact on merge (compact-on-merge.yml): The compact job now runs whenever a PR to main is merged, without requiring head_ref == 'trunk'.

Removed trunk-guard.yml, which blocked any PR into main unless the source branch was trunk.

^{Reviewed by Cursor Bugbot for commit 00b72b1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🟡 Fork PR summaries cannot be pushed

When a forked PR merges, compact runs with the read-only token granted to pull_request workflows. The commit step cannot push a generated summary to main.

Learn more

A merged fork PR now passes the compact job's gate. GitHub limits the token in fork-originated pull_request workflows to read permissions unless an administrator explicitly permits write tokens. The job requests contents: write, but its commit step cannot push when compaction produced an artifact.

Example: A contributor merges a fork PR with a matching trajectory. The job creates a summary, commits it locally, then git push fails with insufficient permissions instead of saving the summary on main.

Recommended fix: Trigger the merged-PR automation through a trusted event with write access, such as pull_request_target for closed events, while checking out and executing only trusted base-branch code. Check the job's permission model for fork merges before relying on contents: write.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 Squash-merged PR trajectories go missing

When a squash-merged branch is deleted, compact cannot resolve its head SHA from the main checkout. The commit selection silently falls back to PR-number matching, which misses trajectories identified only by commits.

Learn more

The newly eligible ordinary PRs can be squash-merged and their source branches deleted. The workflow checks out main and selects original PR commits using the PR head SHA. If the head is not reachable through any fetched branch, git log fails; piping its output into paste yields an empty result without stopping the step. The fallback selects by PR number, while loadTrajectories only matches that number in a task title, description, or commit string, not in the squashed commit's history.

Example: A feature branch containing commit A is squash-merged as commit B, then deleted. A completed trajectory records A but not #41 in its task. The job cannot look up A, finds no matching PR-number text, and saves no summary.

Recommended fix: Preserve or explicitly fetch the PR head commit before it becomes unavailable, or identify the merged PR's trajectories through durable metadata that survives squash and branch deletion. Ensure failure to resolve the commit list does not silently substitute an unrelated filter.

---

Was this helpful? React with 👍 or 👎 to provide feedback.