v0.1.13

The reusable gate can fold its qualification check into the caller's required qualification job, so an opted-in tool pays for one aggregation job per run instead of two.

• tool-gate.yml takes a new caller-qualification input (default false) and exposes a lane-result output: the status of the exact-SHA gate lane. A skipped lane emits nothing.
• With caller-qualification: true, the reusable gate / qualification job is skipped. The caller's own qualification job must then run with if: always() and require both needs.gate.result and needs.gate.outputs.lane-result to equal success. A reusable workflow whose jobs were all skipped can report success, so checking its result alone is unsafe. Toolkit's .github/workflows/gate.yml is the reference.
• Don't opt in where branch protection requires gate / qualification, because that check is skipped once you opt in. Repositories that require the plain qualification check, or have no protection at all, can opt in.
• On an opted-in caller, a draft PR fails with gate not qualified rather than draft: gate not run. It still fails closed.
• The default leaves existing callers unchanged. The Go module API, CLI parsing and output are unchanged from v0.1.12, so no caller goldens should change.

Opting in means editing the caller's gate workflow:

jobs:
  gate:
    uses: 0xble/toolkit/.github/workflows/tool-gate.yml@v0.1.13
    with:
      caller-qualification: true
  qualification:
    runs-on: ubuntu-slim
    needs: [gate]
    if: always()
    steps:
      - env:
          GATE_RESULT: ${{ needs.gate.result }}
          LANE_RESULT: ${{ needs.gate.outputs.lane-result }}
        run: |
          [ "$GATE_RESULT" = success ] && [ "$LANE_RESULT" = success ]