ci: a pull request from a fork runs the no-install gates on Linux (#403)

The gates of scripts/gates.sh that need neither the install nor a display (fmt, clippy, the
workspace tests without an install, the doc-link and render-pass lints, the player build and its
tests), on ubuntu-latest, so a red pull request is seen before anyone builds it. A branch of this
repository skips the job: it runs the full chain before it lands. The job reads the repository
only, keeps no credentials in the checkout, pins its two actions by commit, drops debuginfo for
the runner's disk and caches dependencies. gates.sh and CONTRIBUTING say what runs where.

actionlint passes; the system packages are the ones CONTRIBUTING names for Linux. The workflow's
first run is a manual one on main once it lands.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,54 @@
+# The gates of scripts/gates.sh that need neither a WoW install nor a display, on Linux, for a pull
+# request from a fork: a red one is seen before anyone builds it. The data-gated tests, the engine
+# boot checks and a live run happen on the maintainer's machine before it lands.
+name: CI
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gates:
+    # A branch of this repository runs the full chain before it lands; a fork's pull request runs here.
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 150
+    env:
+      CARGO_TERM_COLOR: always
+      CARGO_INCREMENTAL: 0
+      # No debuginfo: it is most of target/, and a runner's disk is small.
+      CARGO_PROFILE_DEV_DEBUG: 0
+      # Set and empty: no install, as the gates' test-no-install runs.
+      WOW_DATA: ""
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Free disk space
+        run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+      - name: System libraries
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq pkg-config libasound2-dev libudev-dev
+      - name: Toolchain
+        run: rustup toolchain install && rustc -V
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - name: fmt
+        run: cargo fmt --all -- --check
+      - name: clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: test
+        run: cargo test --workspace
+      - name: doc-links
+        run: scripts/doc-links.py
+      - name: pass-span-lint
+        run: scripts/pass-span-lint.py
+      - name: player-build
+        run: cargo build -p benilla --no-default-features
+      - name: player-tests
+        run: cargo test -p benilla-formats -p benilla-app --no-default-features --lib

docs/CONTRIBUTING.md

@@ -26,7 +26,8 @@ fork, and forks are welcome.
 1. `scripts/gates.sh` is green: fmt, clippy with warnings denied, the workspace tests (once
    with the client data, once without, so a test that reads the install has to declare it), the
    doc-link and render-pass lints, the player build with its own tests, and the engine boot
-   checks.
+   checks. A pull request from a fork runs the ones that need neither the install nor a display
+   in CI, on Linux; the rest run on the maintainer's machine before it lands.
 2. The reference fact is stated: what 1.12.1 does, and where that is known from (the client's
    behaviour you observed, a DBC field, a FrameXML line, a packet capture). The names and shapes
    under `reference/` are the surface benilla tracks.

scripts/gates.sh

@@ -6,6 +6,8 @@
 # run stamps the tree, which then re-greens without running. GATES_FORCE=1 runs the chain anyway,
 # WOW_DATA picks the install (set and empty: none) and TMPDIR holds the scratch files; the script
 # sets BENILLA_REQUIRE_DATA, BENILLA_SKIP_LOG and WOW_WORLDVIEW_CHECK for its gates.
+# `.github/workflows/ci.yml` runs the gates that need neither the install nor a display on a fork's
+# pull request: a gate added here goes there too, if it can run on a bare Linux runner.
 #
 #   scripts/gates.sh
 set -uo pipefail