Split workflows into ci-pr + ci-main

[gmarzot]

Summary

• Split verify.yml into ci-pr.yml (PR only) and ci-main.yml (main push only) to eliminate skipped job clutter in the Actions graph
• Fold publish.yml and notify-main-failure.yml into ci-main.yml with aggregate Slack + email notifications matching the moxygen pattern
• Update setup-deps-tarball.sh to reference omoq-ci-main.yml (renamed from omoq-publish-artifacts.yml in moxygen PR Fix publish: skip system dep check for --from-release --no-fallback #69)
• cancel-in-progress: false on ci-main (mutates external state); true on ci-pr (safe for PRs)
• No workflow_dispatch on either file (only needed for version-release)

Workflow structure

PR (ci pr): format, build (linux, asan debug) — no gray circles, no skipped jobs

Main push (ci main): format, build, publish, release, notify — all jobs run

Coordination

Must be merged in coordination with moxygen PR #69 which renames the publish workflow file.

Test plan

• PR CI fires ci pr with format + build only, no skipped jobs
• Main push fires ci main with full pipeline
• Notifications aggregate all job statuses
• setup-deps-tarball.sh finds moxygen artifacts via omoq-ci-main.yml

---

This change is 

[gmarzot]

expected to fail until moxygen pr #69 lands.. neefs to be exercised in o-rly main

[afrind]

Overall: Clean companion to moxygen #69, applying the same pattern. The key design decisions from that review
(no workflow_dispatch, cancel-in-progress: false on ci-main, cancel-in-progress: true on ci-pr) are all
correctly carried over.

---

One Issue Worth Noting

format doesn't gate release

The release job has needs: [build, publish] but not format. So if format fails (unlikely post-PR, but
possible), the release would still publish. The notify job does include format in its needs, so the status is
reported — but the release isn't blocked.

In moxygen there's no format job so this pattern doesn't exist there. Whether to add format to release's
needs depends on how strict you want to be. Given format is a required PR check, broken formatting shouldn't
land on main, but if it ever did, you'd still cut a release.

---

Correctly Carried Over from Moxygen #69

• cancel-in-progress: false on ci-main ✓
• No workflow_dispatch on ci-main ✓
• Aggregate notify with per-job status symbols ✓
• publish needs: [build] fixing the independent-publish problem ✓
• release needs: [build, publish] ✓

Script Update

The setup-deps-tarball.sh change from omoq-publish-artifacts.yml → omoq-ci-main.yml is correct and is the
direct coupling point with moxygen #69 — these two PRs need to land together (already noted in the PR
description).

Inherited Non-Issues

• JSON injection in notify steps — same pre-existing pattern as moxygen, same low risk
• Branch protection rename from "verify" → "ci pr" — same concern as moxygen, needs updating in repo settings

Nothing blocking here. The format→release gating question is the only real decision to make.

@afrind partially reviewed 5 files and all commit messages, and made 1 comment.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on gmarzot).