fix(web): no-project drafts follow load balancing (carry upstream #31049, parked)

.github/fork-ci-release-rulesets.json

@@ -0,0 +1,18 @@
+[
+  {
+    "name": "fork-ci release tags: never moved or deleted",
+    "target": "tag",
+    "enforcement": "active",
+    "bypass_actors": [],
+    "conditions": { "ref_name": { "include": ["refs/tags/ci/*"], "exclude": [] } },
+    "rules": [{ "type": "deletion" }, { "type": "update" }]
+  },
+  {
+    "name": "fork-ci release branch: no force push or delete",
+    "target": "branch",
+    "enforcement": "active",
+    "bypass_actors": [],
+    "conditions": { "ref_name": { "include": ["refs/heads/ci-release"], "exclude": [] } },
+    "rules": [{ "type": "deletion" }, { "type": "non_fast_forward" }]
+  }
+]

.github/fork-ci-release.json

@@ -0,0 +1,9 @@
+{
+  "_comment": "The fork-ci release (.github/scripts/fork-ci-release.py, fork-ci/README.md). paths: the only files a release commit holds, at the same paths as on sourceBranch. legacyTags: tags made before release commits existed (they name a sourceBranch commit, not a release commit, and stay where they are).",
+  "sourceBranch": "main",
+  "requiredCheck": "fork-ci-result",
+  "branch": "ci-release",
+  "tagPrefix": "ci/v",
+  "legacyTags": ["ci/v1"],
+  "paths": ["LICENSE", "fork-ci", ".github/workflows/fork-pr-queue.yml"]
+}

.github/fork-ci-tests.txt

@@ -0,0 +1,39 @@
+# Every test file under .github/scripts and fork-ci (*.test.*, subdirectories included) and
+# where it runs (.github/scripts/fork-ci-tests.cjs checks this list).
+#   <test>                  run by the workflows job, by extension (sh, py, cjs, mjs, js)
+#   <test> run by <file>    run by <file>, which must name the test's path (not one
+#                           of upstream's workflows: they are disabled in the fork)
+# A present test that is not listed fails. A listed file that is not present yet
+# is a note; one that was present and then deleted fails.
+.github/scripts/fork-ci-tests.test.cjs
+.github/scripts/fork-contracts.test.py
+.github/scripts/fork-fleet.test.py
+.github/scripts/fork-follow.test.sh
+.github/scripts/fork-interaction-limit.test.sh
+.github/scripts/fork-pr-queue-workflow.test.py
+.github/scripts/fork-ci-release.test.py
+.github/scripts/fork-release-workflow.test.py
+.github/scripts/fork-release.test.sh
+.github/scripts/fork-schema-check.test.cjs
+.github/scripts/fork-secret-scan.test.sh
+.github/scripts/fork-test-shards.test.cjs
+.github/scripts/fork-tests-drift.test.cjs
+.github/scripts/fork-workflow-triggers.test.cjs
+fork-ci/actions/docs-scope/docs-scope.test.py
+fork-ci/actions/gradle-cache/gradle_cache.test.py
+fork-ci/actions/head-check/head_check.test.py
+fork-ci/actions/job-changed/job-changed.test.py
+fork-ci/actions/pr-queue/lens.test.py
+fork-ci/actions/pr-queue/pr_queue.test.py
+fork-ci/actions/pr-queue/tested-base/tested_base.test.py
+
+# Upstream's tests, run where fork-tests.yml follows upstream's ci.yml.
+.github/scripts/check-nightly-release.test.cjs run by .github/workflows/fork-tests.yml
+.github/scripts/mobile-preview-comment.test.cjs run by .github/workflows/fork-tests.yml
+.github/scripts/stage-preview-bundle.test.py run by .github/workflows/fork-tests.yml
+.github/scripts/test-delta.test.cjs run by .github/workflows/fork-tests.yml
+.github/scripts/vercel-deployment-output.test.cjs run by .github/workflows/fork-tests.yml
+# Upstream runs this one from thread-transfer-report.yml (workflow_run of the disabled CI).
+.github/scripts/thread-transfer-report.test.cjs run by .github/workflows/fork-tests.yml
+# Release Smoke runs scripts/release-smoke.ts, which runs this one.
+.github/scripts/relay-state-output.test.cjs run by scripts/release-smoke.ts

.github/fork-fleet.json

@@ -0,0 +1,60 @@
+{
+  "_doc": [
+    "Where fork-tests.yml's Linux jobs run: this repository's own fleet of self-hosted runners, or GitHub-hosted.",
+    "The one place for every fact about this repository and its fleet: .github/scripts/fork-fleet.py has none.",
+    "Read by `route` (a step of fork-tests.yml's changes job), `watch` (fork-tests.yml), `sweep` (fork-fleet.yml),",
+    "and on each fleet host by `dispatch` and `gate` (an installed copy of main's script and of this file).",
+    "The setting is the repository variable named in `variable`: auto (unset too), fleet or github.",
+    "Runbook, owner steps and the failure table: .github/fork-fleet.md."
+  ],
+  "repository": "scuttletoby/t3code",
+  "variable": "CI_RUNNERS",
+  "hosted": "ubuntu-24.04",
+  "trusted": {
+    "workflows": [".github/workflows/fork-tests.yml"],
+    "actors": ["scuttletoby"],
+    "push_branches": ["main"]
+  },
+  "upstream_sync": {
+    "_doc": [
+      "Upstream's code runs on GitHub-hosted runners only (owner decision). The daily sync pushes main with the owner's",
+      "token, so its push run would pass `trusted`: scripts/fork-follow-push.sh tags each commit it moves main to as",
+      "<tag_prefix><sha> before the move, and a push run of a tagged commit never uses the fleet. Keep the tags: a",
+      "run can be re-run for 30 days."
+    ],
+    "tag_prefix": "fork-follow/synced/"
+  },
+  "pools": [
+    {
+      "_doc": "The owner's PC: its dispatcher runs on the always-on host and starts runners on the PC over ssh.",
+      "name": "pc",
+      "label": "fleet-pc-t3code",
+      "slots": 1,
+      "beacon": "FLEET_BEACON_PC",
+      "launch": ["/opt/fork-fleet/launch-pc"],
+      "waits": false
+    },
+    {
+      "_doc": "The always-on host (the owner's workspace, not a VM of its own): each runner runs as its own user in its own network namespace with internet only (fork-fleet.md, Containment). Fleet mode queues here.",
+      "name": "vm",
+      "label": "fleet-vm-t3code",
+      "slots": 2,
+      "beacon": "FLEET_BEACON_VM",
+      "launch": ["/opt/fork-fleet/fork-fleet-launch.sh"],
+      "waits": true
+    }
+  ],
+  "beacon_fresh_seconds": 180,
+  "stuck_seconds": 600,
+  "fleet_stuck_seconds": 7200,
+  "dispatch": { "every_seconds": 20, "beacon_seconds": 60, "idle_passes": 3 },
+  "jobs": [
+    { "job": "test", "shards": 2, "gates": ["test"], "memory_mb": 4096 },
+    { "job": "test_web", "shards": 2, "gates": ["test_web"], "memory_mb": 4096 },
+    { "job": "build", "gates": ["build", "typecheck"], "memory_mb": 4096 },
+    { "job": "lint", "gates": [], "memory_mb": 3072 },
+    { "job": "rust", "gates": ["rust"], "memory_mb": 2048 },
+    { "job": "test_server", "shards": 8, "gates": ["test_server"], "memory_mb": 3072 },
+    { "job": "release_smoke", "gates": ["release_smoke"], "memory_mb": 2048 }
+  ]
+}