[ccf-lisa]

Task: W1-S2-T01

Part 1 of 3 of the api onboarding stack (CCF Release Automation Design).

Replaces the repo's CI with a caller of the shared ci-go-service.yml from compliance-framework/workflows, pinned at the v1.5.0 release commit (899dbe5). The status check to require from now on is ci / required.

Removes: .github/workflows/ci.yml (the old CI workflow). It is replaced in place by the new ci.yml caller. No other workflow called it.

What the new caller sets

• prepare-command: make swag, so the Swagger docs are regenerated before vet, the tests and the make targets, as the old unit and integration jobs did.
• make-targets: test-integration check-diff.
• lint-timeout-minutes: 30 (the old lint job ran with --timeout=30m).
• Triggers: pull_request types [opened, edited, synchronize, reopened, labeled, unlabeled, closed] and pushes to main, as on mock-api.
• A notify job calling notify-failure.yml with secrets: inherit.

Test race fix

The stack also fixes a pre-existing test race that the new -race flag surfaced: in internal/service/scheduler/scheduler_test.go, mockJob.Execute wrote its executed and execCount fields from overlapping cron goroutines while the test read them (TestCronScheduler_StartStop failed on #487). The fields are now atomic.Bool and atomic.Int32, read with Load(); no non-test code changes. Locally, go test -race -count=20 ./internal/service/scheduler/... passes with the fix and reported the race in 1 of 20 runs without it. A sweep of the other test doubles found none mutated from goroutines the code under test starts.

Old jobs and where they run now

Old job (check name)	Old command	New check	Notes
lint	golangci-lint v2.11.4, --timeout=30m, default linters	ci / golangci-lint	Same golangci-lint version. Reports only issues the change adds (new-from-merge-base). api has no .golangci.yml, so the shared base config applies.
unit-tests	make swag then make test	ci / go	go test -race ./... (the race detector is new), plus gofmt, go vet, a go mod tidy check and go build.
integration-tests	make swag then make test-integration	ci / make	Same make target. The tests start postgres:17.5 through testcontainers; the old job had no workflow services, and the new runner (ubuntu-latest) has Docker too. The old job took about 8 minutes; the make job's timeout is 30.
check-diff	make check-diff (PRs only)	ci / make	Same make target. It now also runs on pushes to main, where the old job was skipped.
(none)		ci / common	New: PR title check, vulnerability scan and actionlint.

Trigger change: the old workflow also ran on pushes to release-* branches. None exist, and from T02 on, releases are cut from main by release-please, so the new caller runs on main only.

Legacy required checks

The main ruleset requires integration-tests, unit-tests and check-diff, and the classic branch protection requires unit-tests. None of these run after this PR, so they stay pending here. A human removes the ruleset and the classic protection before the stack merges (W1-S2-PRE); this PR does not touch them.

Verified

• The caller's inputs match ci-go-service.yml at v1.5.0 (prepare-command, make-targets, lint-timeout-minutes).
• .gitignore covers cover.out, which make test-integration writes before check-diff checks the tree.
• No other workflow references the old ci.yml.
• ci / required on this PR's head is the check to read.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6906901b-bb2f-4cb9-ae13-98dd4a9fdfd6

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.