[Mpdreamz]

macOS jobs now run only on pushes to main, and a release ships only a commit whose main CI run passed.

Prompt summary: Take macOS off pull requests and the release path, since those runners are severely constrained, and make every release check that main is green first.

What

• build (shared dotnet-ci.yml): os is ["ubuntu-latest", "macos-latest"] on push and ["ubuntu-latest"] on pull requests. It does not run on release.
• release calls the shared release.yml at v1.6.1, whose main-green job waits for main's ci.yml run on the released commit and fails unless it passed. The job now needs only zizmor, and it grants actions: read.
• All nullean/.github refs in ci.yml (including nuget-publish) are bumped to v1.6.1.

Event	Jobs that run (runners)
pull_request	build / ci (ubuntu-latest); zizmor — no macOS
push to main	build / ci (ubuntu-latest, macos-latest); zizmor; canary (after build)
release	zizmor → release (main is green → pack) → publish — all ubuntu, no macOS (proc ships no native assets)

Every job that runs on release is downstream of main-green, apart from zizmor. release needs only zizmor, which runs on every event, so no skipped needs blocks it.

Ruleset: build / ci (macos-latest) is a required check, and pull requests no longer produce it. It has to come out of repos.yml and the main ruleset.

Verify

• mise exec actionlint@latest shellcheck@latest -- actionlint: clean.
• zizmor --min-severity medium .github: no findings.
• I walked through the three events by hand (the table above). No CI was triggered for this.

🤖 Generated with Claude Code