[askalf]

Summary

The test matrix ran ubuntu, windows and macos, each on Node 20, 22 and 24: nine jobs. After this it runs four.

	before	after
ubuntu	20, 22, 24	20, 22, 24
windows	20, 22, 24	22
macos	20, 22, 24	none

• macOS goes: it runs nothing Linux doesn't. CI sets CANON_NO_KEYCHAIN=1, and keychain.test.mjs drives a fake keychain, so the macOS-only branch (security in src/keychain.mjs) never runs in CI.
• Windows stays: it's the only place the Windows-only behaviour runs, such as the lock guard that read as EPERM mid-release (lock: a guard mid-release reads as EPERM on Windows — treat it as contention #197). The packed tarball job also keeps its Windows entry.
• One Node version on Windows: that behaviour doesn't vary by Node version, so Node 22 covers it.
• Windows becomes non-required: it runs on GitHub's runners. While it's required, a hosted outage or an Actions billing block holds every merge here, as one did today.
• CONTRIBUTING.md now lists the required checks as they will be.

Check names after this: test (ubuntu-latest, 20), test (ubuntu-latest, 22), test (ubuntu-latest, 24), test (windows-latest, 22).

Ruleset (before merge)

The master protection ruleset requires test (windows-latest, 20), test (macos-latest, 20) and test (macos-latest, 22), which this removes, and test (windows-latest, 22), which becomes optional. All four have to come off the required list before this merges; otherwise every PR waits on checks that never report. Staged for the operator as RUN-ruleset-windows-optional.sh.

Tests

• node scripts/fleet-status.test.mjs: 180 pass. Its runner checks evaluate the unchanged runs-on expression.
• The workflow parses, and its matrix expands to the four names above.

[sprayberry-redline]

Verdict: approve. The matrix produces three Ubuntu jobs and one Windows job on Node 22 while preserving runner selection and the packed-tarball checks. The contributor guidance matches the intended required checks, subject to the ruleset update explicitly called out before merge.