ci: add CI gate for branch protection (RIG-2213)

.github/workflows/pr-test.yml

@@ -27,6 +27,15 @@ concurrency:
 jobs:
   pipeline:
     name: pipeline (${{ matrix.system }})
+    # RigelBuild fork: this matrix runs on upstream Cachix's self-hosted
+    # runners (warm nix store + native Apple Silicon), which RigelBuild has
+    # no runners registered for — so on the fork every leg sits `queued`
+    # forever. The fork's real PR build gate is the standalone rigel-ci.yml
+    # `CI` producer (`nix build .#devenv` on a GitHub-hosted runner), which is
+    # also the branch-protection pin target. Scope this inherited matrix to
+    # the upstream owner so it skips cleanly on the fork rather than hanging.
+    # (The richer multi-arch build + cache-push gate is RIG-2449.) (RIG-2213)
+    if: github.repository_owner == 'cachix'
 
     strategy:
       fail-fast: false

.github/workflows/rigel-ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+# Branch-protection gate producing a check-run literally named `CI` for the
+# fork's `main` ruleset to pin (RIG-2213). Upstream's own pipeline runs on
+# self-hosted runners this fork does not have, so a `needs:`-aggregator over it
+# would sit `queued` forever and wedge the pin. This standalone job runs the
+# same build command upstream's build.yml runs (`nix build .#devenv`) on a
+# GitHub-hosted runner. The devenv substituter is wired explicitly via
+# cachix-action (matching upstream build.yml) rather than the flake's
+# `nixConfig.extra-substituters`, which nix ignores non-interactively without
+# `--accept-flake-config`; without it the build would cold-compile the custom
+# Nix fork + full closure from source and risk exhausting the hosted runner.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: rigel-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  CI:
+    runs-on: ubuntu-latest
+    # Fail fast if a substituter regression forces a cold rebuild of the
+    # closure, rather than hanging to the 6h job default on the pinned check.
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
+      # Pull-only: no authToken (we do not push to upstream's cache from the
+      # fork's PR gate). Names the devenv substituter so the closure — notably
+      # the custom Nix fork `github:cachix/nix/devenv-2.35` and nixd, which are
+      # not on cache.nixos.org — is fetched, not rebuilt.
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: devenv
+      - run: nix build -L --show-trace .#devenv