ci: consolidate trivial gates into hygiene.yml, add concurrency

[acamarata]

Summary

• Consolidates generated-file-gate.yml, multi-arch-check.yml, doc-sync.yml (each a few seconds, no toolchain) into one hygiene.yml job with a single checkout — 1 runner claim per push instead of 3.
• Trigger scope is the union of the three originals — nothing that used to run stops running. doc-sync's steps are guarded to pull_request events only (needs github.base_ref, unset on push).
• clean-root.yml and gitleaks.yml are deliberately left alone, even though clean-root is exactly the class of job this consolidation targets. Both back required branch-protection checks (clean-root, gitleaks) and already carry their own concurrency groups. Per the hard safety constraint on this repo, the safer option is to leave the two checks branch protection depends on for every PR as untouched, standalone files rather than risk a check-name change from folding them into a shared workflow. Verified byte-identical to origin/main.
• nself-first-check.yml, security.yml, desktop-{linux,macos,windows}.yml, mobile-ci.yml, tvos-ci.yml, e2e.yml — untouched, already carry concurrency + tight paths: filters. Nothing to add.
• ci.yml — untouched, already has concurrency. No paths: filter added: 4 of its jobs back required checks (nself CLI Check, Version Lockstep, Mobile Tests (coverage gate ≥60%), I18n Completeness Gate (N-S3-T3)), and GitHub blocks a merge waiting on a required check that paths-ignore prevented from running — path-filtering a workflow carrying any required check is unsafe.
• Adds concurrency to wiki-sync.yml and dependabot-review.yml (both plain push/pull_request, not pull_request_target, so ref-keyed grouping is safe).
• Left alone by design (release/publish/schedule triggers): android-release.yml, ios-release.yml, publish-updater.yml, quarterly-doc-audit.yml, desktop-release.yml (already cancel-in-progress: false, correctly). dependabot-auto-merge.yml untouched (pull_request_target trap).

Safety — required check names verified byte-identical

• clean-root (job id + name: in clean-root.yml) — file diff vs origin/main is empty.
• gitleaks (job id in gitleaks.yml) — file diff vs origin/main is empty.
• nself CLI Check, Version Lockstep, Mobile Tests (coverage gate ≥60%), I18n Completeness Gate (N-S3-T3) (all in ci.yml) — file diff vs origin/main is empty.
• No checks removed, no continue-on-error, no loosened assertions.

Test plan

• actionlint on all 20 workflow files post-change: exit 1, 5 findings — all 5 are pre-existing SC2086/SC2046/SC2012/SC2129/SC2010 style/info notices, one-to-one matched against the origin/main baseline (including the one now in hygiene.yml, copied verbatim from doc-sync.yml)
• actionlint on the origin/main baseline (all 22 original files): exit 1, same 5 findings — zero new findings
• git diff origin/main on clean-root.yml, gitleaks.yml, ci.yml: empty for all three

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
ntask-web	Ignored		Sep 1, 2026 8:44pm UTC