fix(github-status-comments): merge entries across concurrent workflows

.github/actions/install-prebuilt-aspect-cli/action.yaml

@@ -0,0 +1,26 @@
+name: Install prebuilt aspect-cli (from in-run artifact)
+description: |
+  Internal-only — NOT a general-purpose aspect-cli installer.
+
+  Downloads the `aspect-cli` artifact uploaded earlier in this workflow
+  run by the `pre-build` job and installs it on PATH as `aspect`. Used
+  by GitHub-hosted ephemeral runners that don't have remote-cache
+  access to rebuild the CLI from source efficiently.
+
+  To install aspect-cli normally, see https://docs.aspect.build/cli.
+
+runs:
+  using: composite
+  steps:
+    - name: Download aspect-cli binary
+      uses: actions/download-artifact@v4
+      with:
+        name: aspect-cli
+        path: ${{ runner.temp }}/aspect-bin
+    - name: Install on PATH
+      shell: bash
+      run: |
+        chmod +x "${RUNNER_TEMP}/aspect-bin/aspect-cli"
+        mkdir -p "$HOME/.local/bin"
+        mv "${RUNNER_TEMP}/aspect-bin/aspect-cli" "$HOME/.local/bin/aspect"
+        echo "$HOME/.local/bin" >> "$GITHUB_PATH"

.github/workflows/ci-github-runners.yaml

@@ -0,0 +1,95 @@
+name: CI - GitHub runners
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+# The Dash0 OTLP endpoint and bearer token feed `.aspect/config.axl`'s `ctx.telemetry.exporters.add(...)`
+# call, which dogfoods the trace.event/trace.log pipeline against a real backend.
+# Both are no-ops if a secret isn't configured (unset env var = empty string,
+# config.axl skips registration).
+env:
+  ASPECT_API_TOKEN: ${{ secrets.ASPECT_API_TOKEN }}
+  DASH0_ENDPOINT: ${{ secrets.DASH0_ENDPOINT }}
+  DASH0_TOKEN: ${{ secrets.DASH0_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  pre-build:
+    runs-on: [self-hosted, aspect-workflows, aspect-default]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - name: Pre-build CLI
+        run: |
+          echo "Build and upload CLI to remote cache"
+          .aspect/bootstrap.sh
+      # Surface the just-built binary to the ephemeral (GitHub-hosted) jobs
+      # below. Those runners are small and don't have remote-cache access yet,
+      # so we re-use the binary that the self-hosted runner already built rather
+      # than rebuilding from source per ephemeral job.
+      - name: Upload aspect-cli binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: aspect-cli
+          path: target/ci/aspect-cli
+          retention-days: 1
+          if-no-files-found: error
+
+  # Dedicated buildifier-only step that runs in parallel with format-task.
+  # Models the legacy Rosetta `buildifier` task using a Starlark-only
+  # `format_multirun` target — see https://docs.aspect.build/cli/migration/buildifier.
+  buildifier-task:
+    runs-on: ubuntu-latest
+    needs: [pre-build]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+      - uses: ./.github/actions/install-prebuilt-aspect-cli
+      - name: Buildifier Task
+        run: aspect format --task-key buildifier-gha-ephemeral --formatter-target=//tools/format:format-starlark
+
+  format-task:
+    runs-on: ubuntu-latest
+    needs: [pre-build]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+      - uses: ./.github/actions/install-prebuilt-aspect-cli
+      # Starlark patterns are handled by buildifier-task; ignore them here so
+      # the two steps don't do duplicate work.
+      - name: Format Task
+        run: |
+          aspect format --task-key format-gha-ephemeral \
+            --ignore-pattern='**/*.axl' \
+            --ignore-pattern='**/*.bzl' \
+            --ignore-pattern='**/BUILD' \
+            --ignore-pattern='**/BUILD.bazel' \
+            --ignore-pattern='**/MODULE.bazel' \
+            --ignore-pattern='**/WORKSPACE' \
+            --ignore-pattern='**/WORKSPACE.bazel'
+
+  gazelle-task:
+    runs-on: ubuntu-latest
+    needs: [pre-build]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+      - uses: ./.github/actions/install-prebuilt-aspect-cli
+      - name: Gazelle Task
+        run: aspect gazelle --task-key gazelle-gha-ephemeral

.github/workflows/ci.yaml → .github/workflows/ci-workflows-runners.yaml

@@ -1,4 +1,5 @@
-name: CI
+name: CI - Workflows runners
+
 on:
   push:
     branches: [main]
@@ -93,6 +94,7 @@ jobs:
   buildifier-task:
     runs-on: [self-hosted, aspect-workflows, aspect-default]
     needs: [pre-build]
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
         with: