2026-07-05 triage: keeping open, re-scoped. Since this was filed, most per-repo GHA was retired in favor of central Mergify automation (T8937), which shrank the fork-spam surface — but scheduled/cron workflows (e.g. CodeQL callers) still run on forks where jobs lack an owner guard. Remaining work = a fleet sweep adding if: github.repository_owner == 'vyos' (or the schedule-conditional variant) to jobs in scheduled workflows. Small, bounded; will be scheduled as an owner-guard sweep work item.

Resolving in the 2026-07-05 stale-High triage (operator-confirmed). Overtaken by the 2026-05-30 default-branch rename (rollout 1c: 93 renames + ruleset-condition PATCHes) and the 2026-06-02 frozen current backport-alias restore (40 repos), which together resolved the fleet's branch-reference debt. No remaining actionable content identified on this task (empty description).

Resolving in the 2026-07-05 stale-High triage (operator-confirmed). Delivered: the Mergify conflict check ships fleet-wide via the central baselines (vyos/mergify + VyOS-Networks/mergify, consumed by extends: on ~105 repos) — Label conflicting pull requests rule + conflicts merge-protection gate (T8615/T8935, shipped 2026-05-28).

Resolving in the 2026-07-05 stale-High triage (operator-confirmed). Delivered by later work: the custom/eps1lon conflict-check GHA was retired under T8937 (retirement closed 2026-06-12); conflict detection now runs via the central Mergify Label conflicting pull requests rule (T8615/T8935) plus the committed-marker script path (T8934). Nothing left to disable.

Typos-check pilot COMPLETE — 2026-06-29.

Phase 1 + Phase 2 (evaluate) progress — 2026-06-19:

Taking over from @Vijayakumar and re-scoping. Research outcome: Mergify cannot run content scanners (it only gates on *existing* check results), so the path forward is fleet-wide-capable enforcement via a GitHub repository ruleset ("require workflows to pass") — no per-repo caller files — piloted on vyos-1x / vyos-build / vyatta-cfg-system / vyconf (branches rolling/circinus/sagitta) in evaluate → active mode, with a rebuilt standalone typos.yml (official crate-ci/typos action, prebuilt binary, fork-safe on: pull_request, full-tree scan, central _typos.toml allowlist). The per-repo-caller rollout (stalled ~2 months at 1 repo) is superseded.

Status check 2026-06-18 (triage of open GitHub Infrastructure tasks). @Vijayakumar — current state of this rollout:

Resolving — superseded by T8782 (IS-432, Passed). The centralization goal (eliminate per-repo Mergify-config duplication via extends; future policy changes = 2 PRs not 30+) is delivered fleet-wide — but via dedicated vyos/mergify + VyOS-Networks/mergify repos with extends: mergify, not this task's extends: .github design (the bare mergify repo name was chosen for fleet symmetry, and .github-repo hosting was dropped). Live on ~55 product repos; fleet extends adoption tracked/closed under T8852. No per-repo config duplication remains. Closing as resolved (delivered via sibling); Jira companion IS-404 being cancelled as superseded by IS-432.