build(ci): Add lightweight Velox premerge gate

[sperlingxx]

Summary

• Replace the inherited broad pull-request matrix with a deterministic five-minute Phase 0 gate.
• Keep the original pre-commit and title policies, and add workflow contract tests plus change classification for native CPU, Spark-MPP cuDF, Spark-MPP UCX, and dependency changes.
• Restore only two measured GitHub-hosted lanes: Breeze CPU sanitizer build/tests and documentation validation.
• Preserve heavy native coverage behind the trusted Blossom/Jenkins comment lane and retain manual, scheduled, and upstream-push entry points.
• Harden Blossom by replacing the disallowed subdirectory checkout action, pinning all actions to immutable SHAs, and using read-only permissions.

Premerge surface

Check	Trigger	Measured duration
Velox Phase 0	Every PR to dev	2s–54s
Breeze CPU sanitizer build + CTest	Breeze, Perfetto, CMake, or setup changes	3m12s–3m23s
Documentation build	Documentation changes	1m53s–2m50s
Blossom/Jenkins native CI	Authorized build comment	Pending runner integration

Every hosted job added by this PR has a five-minute timeout. The unavailable Breeze GPU runner, macOS, general Linux builds, fuzzers, dependency graph, benchmarks, PyVelox wheels, and bundled-dependency builds remain outside automatic PR CI.

Validation

• The branch is based directly on merged PR build: Setup blossom-ci #24 and is current with dev.
• The exploratory canary/revert history has been collapsed into one reviewable commit.
• 16 Python unit and workflow-contract tests pass.
• The full Velox pre-commit suite passes, including license, formatting, Ruff, ShellCheck, YAML, zizmor, and action-validator checks.
• git diff --check passes.
• Deleted files are included in change classification, preventing deleted native sources from being misclassified as non-native.

Blossom integration status

The trusted issue_comment workflow is loaded from the default branch. The #24 version there still uses the disallowed NVIDIA/spark-rapids-common/checkout@main subdirectory action; this PR replaces it with the allowed, SHA-pinned official checkout action.

A runner-smoke dispatch on the PR head reaches workflow scheduling, but the repository currently reports zero available self-hosted runners and the blossom job remains queued. The stale smoke was cancelled. This PR must stay draft until:

1. an online runner with label blossom is shared with HighPerfDataAccelerator/velox;
2. runner smoke passes on the final PR SHA;
3. the integrated Authorization → Vulnerability scan → Start CI job path completes for that same SHA.

Security boundary

PR-authored code never runs automatically on the privileged Blossom runner. The comment-triggered workflow remains default-branch-controlled and restricted to the existing maintainer allowlist.

[sperlingxx]

build

[sperlingxx]

Supersession map

This combined draft has been split onto current dev into independently reviewable successors:

• build(ci): Prune unpromoted Velox premerge workflows #43 — trigger-only pruning replacement (13 broad/helper workflow files)
• build(ci): Add Velox Phase 0 gate #44 — Phase 0 classifier, focused self-tests, and stable aggregate gate
• build(ci): Enable hosted Phase 0 lanes #46 — HPA Breeze CPU and documentation hosted lanes
• build(ci): Harden Blossom control plane #45 — Blossom control-plane hardening and isolated runner smoke

RoadMap #27 now tracks those PRs and their exact heads instead of requiring #25 to move from Draft to Ready.

The dependency-graph.yml edit from this draft was intentionally not transplanted; dependency-graph/selective-target validation remains a Phase 3 P0 manual-canary item in #27.

PR #25 remains open for final backlink verification and can then be closed explicitly as superseded, not completed.