ci: delete the pull-request contract workflows replaced by ci-status

[kyle-sexton]

No related issue: melodic-software/github-iac#396 tracks Phase 3 of the ci-perf program

Summary

Since standards#526 merged, the pr-contract composite runs as a step inside the required ci-status job, and Phase 3.3 (github-iac run 33954697296) narrowed the org ci-gate ruleset so ci-status is the only required context on main. The three standalone callers .github/workflows/pr-title.yml, .github/workflows/do-not-merge.yml and .github/workflows/pr-issue-linkage.yml therefore emit contexts nothing depends on while paying for a runner twice on every pull-request event. Two of them also ran on pull_request_target, the last such triggers in this repository.

Fix

Delete the three callers. Nothing else in .github/workflows/ changes, and ci.yml is untouched: the exempt-authors value the linkage caller carried, dependabot[bot], already sits on the pr-contract step, so Dependabot's bodies keep skipping the linkage check exactly as before.

Three repository-owned sentences named a deleted file or the retired reusable as the enforcing gate and are now accurate:

• conventions/review/code-quality.md pointed at .github/workflows/pr-title.yml as the wiring; it now names the pr-contract composite inside ci-status.
• conventions/process/issue-tracker.md said the pr-title gate enforces Conventional Commits titles and that the shared pr-issue-linkage gate mechanically enforces the body contract; the first now names the composite, and the second records the current posture, which is advisory (an upserted comment plus the needs-issue-linkage label), not a red check.
• distribution/sync-manifest.yml described the pr-body-contract-rule entry as being for every pr-issue-linkage gate caller; those callers are what this pull request deletes.

The ci-workflows reusables semantic-pr.yml, do-not-merge-gate.yml and pr-issue-linkage.yml are untouched, as are the do-not-merge and needs-issue-linkage labels, which remain real.

Verification

Pre-push, on the worktree at origin/main 36019f27defd2840032431d736089af7f6bac9f6:

• grep -rl "pull_request_target" .github/workflows/ returns nothing.
• ls .github/workflows/ | grep -cE "^(pr-title|do-not-merge|pr-issue-linkage(-self)?)\.yml$" prints 0.
• actionlint .github/workflows/*.yml exits 0 with no output.
• zizmor --persona regular .github/workflows/ reports 63 findings (4 ignored, 58 suppressed): 1 informational, 0 low, 0 medium, 0 high. The origin/main baseline is 70 findings (6 ignored, 63 suppressed): 1 informational, 0 low, 0 medium, 0 high. The one informational finding, use-trusted-publishing, is the same one on both trees; nothing new is reported.
• yq '.permissions' .github/workflows/ci.yml prints contents: read.
• npm run lint:runner-policy: Runner policy passed.
• npm run lint:concurrency-policy: Concurrency policy passed.
• npm run lint:dependabot-policy: Dependabot policy passed.
• npm run test:runner-policy: 288 pass, 0 fail.
• npm run test:concurrency-policy: 25 pass, 0 fail.
• npm run test:pr-convention-policy: 11 pass, 0 fail.
• npm run test:pr-convention-lockstep: 36 pass, 0 fail.
• git diff origin/main --stat is six files: the three deletions and the three prose files.

Nothing in components/ or distribution/ reads the deleted files. components/pr-convention-policy/lockstep-drift.mjs resolves every consumer over the GitHub contents API at that repository's main, scans ci.yml first, and short-circuits on the composite in detectArtifactPin, so this repository's local pr-issue-linkage.yml was never read; its REUSABLE_PATH constant is dereferenced only for a repository that resolves to kind: "reusable". distribution/sync-manifest.yml lists none of the three files as a distributed path; the only mentions are comments.

Live proof follows on this pull request: the deleted contexts must not appear on the head, ci-status must be green, and its pr-contract step log must show the title check and the linkage check running.

Related

Refs melodic-software/github-iac#396
Refs melodic-software/github-iac#378

[claude]

Claude finished @kyle-sexton's task in 1m 43s —— View job

---

Code review complete

• Gather context (PR body, diff, changed files)
• Read changed files and surrounding context
• Verify claims made in PR body (grep checks, lockstep script behavior)
• Post findings as inline comments (if any)
• Final summary

Scope: clean deletion of three now-redundant standalone required checks (pr-title.yml, do-not-merge.yml, pr-issue-linkage.yml), plus three prose updates that named them as the enforcing gate.

Verification performed:

• Confirmed .github/workflows/ci.yml already runs the pr-contract composite as a step inside the required ci-status job (ci.yml#L1134-L1142), carrying the same exempt-authors: 'dependabot[bot]' value the deleted pr-issue-linkage.yml caller had — the PR's central claim checks out, and ci.yml itself is untouched by this diff.
• Grepped the repo for pull_request_target, pr-title.yml, do-not-merge.yml, and pr-issue-linkage.yml: no remaining consumer reads the deleted files. The hits in components/runner-policy/runner-policy.test.mjs are synthetic in-memory fixture strings, unrelated to the real deleted paths. The hits in components/pr-convention-policy/lockstep-drift.mjs and its README are pre-existing transition-tracking code that already special-cases either artifact shape and isn't affected by deleting this repository's own caller.
• Confirmed distribution/sync-manifest.yml's pr-body-contract-rule entry lists no distributed path pointing at the deleted files — only the touched comment mentioned them.
• The three prose edits in conventions/process/issue-tracker.md and conventions/review/code-quality.md accurately reflect current enforcement (composite-inside-ci-status, advisory posture for the body/linkage contract via comment + needs-issue-linkage label rather than a failing check).
• Single commit, diff matches the stated stat (3 deletions, 3 one-line prose fixes), no .github/workflows/ files other than the three deletions are touched.

No correctness or maintainability issues found — no inline comments filed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T08:43:18.003097Z	960e0e5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 960e0e55c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".