[boeboe]

Moves profinetctl to otfabric/engineering policy 1.6 and the current shared workflows (otfabric/.github v3.8.0), and to the PR workflow: heavy validation runs once per pull request revision, behind one required check.

What changes

• pr.yml (new) runs on every pull request, with no path filter: docs always; ci unless every changed file is documentation (pr-changes.yml); then OT Fabric Required Checks (actions/required-gate), which fails closed.
• Heavy workflows lose their push and pull_request triggers and become workflow_call + workflow_dispatch. Their jobs, matrices and permissions are unchanged. A schedule trigger stays.
• No CI on a branch push or on the push to main any more, except the light checks on main. The merged commit was tested as the pull request's merge commit; a release tests the release commit again.
• Policy pin 1.4 → 1.6 (.otfabric/policy.yaml); the checker runs at v1.6.1.
• Pins: docs-check, go-binary-release, go-ci, pr-changes, required-gate at v3.8.0 (were v3.3.1, v3.5.0, v3.6.0). No input of a shared workflow was removed between those tags.
• otfabric-policy runs once, in the light check (every pull request and every push to main), no longer a second time inside go-ci.

Files

• .github/workflows/ci.yml
• .github/workflows/docs.yml
• .github/workflows/pr.yml (new)
• .github/workflows/release.yml
• .otfabric/policy.yaml
• AGENTS.md
• CONTRIBUTING.md

Quality gating

Every job that ran on a pull request before still runs on a pull request that changes code, and the single required check covers all of them. Nothing is weakened: no test, threshold, matrix entry or tool version is changed by this pull request.

Checks run locally

otfabric-policy check . at v1.6.1: compliant. make docs-check (docsync v0.3.1): clean. go build ./... and go vet ./...: clean.

Not run: actionlint.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!