One workflow: checks, dry run, then the approved apply

[TakGN]

A merge started two runs (checks and platform), and its apply followed the checks without a dry run of the commit being applied.

Now: one workflow, one run, in this order

merge -> ansible · manifests · generated · shell + changes
      -> platform-dry-run  (what would change, written to the run's summary)
      -> platform-apply    (approval in `production`) -> platform.yml

• platform.yml is deleted; its jobs live in ci.yml.
• changes decides whether the run touches what platform.yml applies (platform.yml, its roles, route_origin defaults, group_vars/, inventory/, scripts/ci-platform.sh, the workflow). On a PR it diffs against where the branch left main. Tested on real ranges: Install Argo CD on lith-1 and open the ports monitoring needs #2 and Apply platform.yml only after the checks pass, and never cancel a pending apply #3 merges → yes; a content-role-only change → no; a group_vars change for another service → yes (then the dry run shows it changes nothing).
• platform-dry-run runs after every check passes: on PRs from this repo, on merges, and on manual runs. It writes a table of what would change, per box and task, plus failures and the play recap, to the run's summary page. Tested with a stubbed playbook, passing and failing (a failure fails the job, so no apply is offered).
• platform-apply needs the checks and the dry run of the same commit, and waits for approval in production: approve after reading the dry run's summary.
• Concurrency: on main the dry run and apply queue together in platform-main (a dry run never runs while an apply changes the boxes; a newer merge replaces an older one still waiting for approval). PR dry runs keep their own per-branch group, so they cannot cancel a pending apply (the Apply platform.yml only after the checks pass, and never cancel a pending apply #3 fix).
• Manual: Actions → ci → Run workflow, platform: none | check | apply, optional limit.

Checked

actionlint (with shellcheck of inline scripts), shellcheck scripts/*.sh, yamllint, ansible-lint (production, 0 failures); the summary rendering with a stub.

Merging

Merging touches the workflow, so its run dry-runs platform.yml and offers the apply for approval. After the pending apply from #3's merge has run, this one should show nothing to change.

🤖 Generated with Claude Code