Adopt the org CI

.github/rulesets/default.json

@@ -0,0 +1,41 @@
+{
+  "name": "default",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    { "type": "required_linear_history" },
+    { "type": "required_signatures" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": ["squash"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "ci / flake-check", "integration_id": 15368 }
+        ]
+      }
+    }
+  ],
+  "bypass_actors": [
+    { "actor_id": null, "actor_type": "OrganizationAdmin", "bypass_mode": "pull_request" }
+  ]
+}

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+# Org standard CI: the external-systems/pkgs org-ci workflow. `nix flake
+# check` on PRs, the merge queue and main; on main, after it passes, the
+# docs/slides deploy to GitHub Pages and a 0.<minor>.<commits> release.
+#
+# Required status check for the ruleset: "ci / flake-check".
+#
+# Private flake inputs (e.g. external-systems/secrets): give the repo the
+# NIX_APP_ID + NIX_APP_PRIVATE_KEY org secrets and add
+# `private-repos: secrets` under `with:`.
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  merge_group:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  ci:
+    uses: external-systems/pkgs/.github/workflows/org-ci.yml@main
+    # The union org-ci's jobs need; each job narrows it to its own.
+    permissions:
+      contents: write
+      actions: write
+      pages: write
+      id-token: write
+    with:
+      # Release series x in 0.x.y.
+      minor: 0
+    secrets: inherit

.gitignore

@@ -2,3 +2,5 @@ result
 result-*
 .devenv*
 devenv.local.nix
+_site/
+site/