CI: Parallelize CI validation

[heymrbox]

Summary

• Run race tests and coverage in parallel.
• Start image build and security validation without waiting for unrelated jobs.
• Aggregate all required jobs under a stable CI Gate.
• Move label-triggered documentation checks into a lightweight Docs Sync workflow.
• Remove the obsolete workflow that deployed the entire repository to GitHub Pages.

Linked issues

N/A

Checklist

Vendor-neutral naming (required — see CONTRIBUTING.md)

• No prohibited vendor naming introduced in core surfaces.
• No cloud-specific integration added outside optional adapters.
• No vendor domains or namespaces added to samples, README, or defaults.
• Pre-commit naming guard passed.

Quality

• Commit includes a matching DCO Signed-off-by: trailer.
• make reuse-lint passes.
• Build and race tests pass locally.
• make lint is clean.
• make manifests generate produces no drift.
• Workflow behavior was validated with actionlint and docs-sync tests.
• N/A — this is not an operator-facing product change.
• CI is green

Contracts (only if touching CRDs or proto)

• N/A — no CRD or proto contract changed.
• N/A — no v1alpha1 consumer behavior changed.
• N/A — proto/ was not changed.
• N/A — CRD API types and proto contracts were not changed.

[github-actions]

Codex review

Files reviewed

.github/workflows/

• .github/workflows/ci.yml [reviewed]
• .github/workflows/docs-sync.yml [reviewed]
• .github/workflows/static.yml [reviewed]

Repository root:

• CONTRIBUTING.md [reviewed]

Findings

Blocking

None.

Should-fix

.github/workflows/docs-sync.yml:29 — Verify: require the new standalone Docs Sync status check in branch protection. It is no longer transitively enforced by the aggregated CI job, so without the repository-setting change a failed documentation-sync check would not prevent merging.

.github/workflows/ci.yml:400 — Verify: update branch protection to require CI / CI Gate and remove the previous aggregate context. Renaming the job changes its status-check context; stale protection configuration can either block every PR or fail to enforce the intended aggregate gate.

Nit

None.

Per-category coverage

1. Vendor-neutral naming: Clean
2. Contract & spec / docs sync: findings above at: .github/workflows/docs-sync.yml:29
3. gRPC fail-open semantics: Clean
4. Quality (tests / error wrapping / package placement / generated drift): findings above at: .github/workflows/ci.yml:400

Verdict

changes-requested

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[heymrbox]

Addressed the branch-protection findings.

The active Main Branch Ruleset now requires these GitHub Actions checks:

• CI Gate
• Docs Sync
• install-smoke
• Analyze (go)

The checks are pinned to the GitHub Actions app, strict up-to-date status enforcement is enabled, and the existing squash-only, code-owner approval, deletion, and non-fast-forward protections were preserved. There was no stale aggregate context in the ruleset to remove; it previously required no status checks.