add generic-rake-test-only variant for least-privilege consumers

[opoudjis]

Closes #362

Summary

Shape 1 from the 2026-07-25 revisit: opt-in generic-rake-test-only.yml reusable + master/rake_test_only.yml cimas template at permissions: contents: read. Existing generic-rake.yml and master/rake.yml untouched — all 48 cascade consumers keep working unchanged.

What it does

Drops the tests-passed job (both tests-passed and do-release repository_dispatch fires) from the reusable. In exchange, callers can declare contents: read at the workflow level — the least-privilege ceiling GitHub Actions permits for a reusable-caller pair. For repos that CI but don't participate in the release cascade (mn-samples-*, metanorma-model-*, externally-triggered releases).

Files

• .github/workflows/generic-rake-test-only.yml — new reusable.
• cimas-config/gh-actions/master/rake_test_only.yml — new cimas caller at contents: read.
• docs/generic-rake.md — new subsection: when to use, when not to, how to switch.

No cimas.yml mappings changed; per-repo opt-in happens in a follow-up wave.

Preference

Naming — is master/rake_test_only.yml (underscore, matching release_manual_notes.yml) right, or would you prefer rake-test-only.yml (hyphen, matching rake-flavor.yml)? Happy to rename before merge.

🤖

[ronaldtse]

Architecture review — reject sibling-workflow fragmentation

This PR ships a 144-line near-duplicate of generic-rake.yml. That is the exact drift risk class (g) of drift-audit was built for, and the PR does not register itself in VARIANT_REGISTRY.

Premise check

Existing generic-rake.yml already declares permissions: contents: read at the workflow level (line 64-65), with tests-passed overriding to contents: write at the job level. What forces callers to escalate is master/rake.yml:9-10 (the caller template). Before forking the reusable, verify whether GHA actually clamps job-level write under a caller-level read. If not, relaxing the caller template alone is sufficient and the duplication is unnecessary.

Required shape (consolidated, not fragmented)

One reusable. One concern. Extended via input:

# generic-rake.yml — add one input
cascade:
  description: >
    When true (default), fire tests-passed / do-release repository_dispatch
    after the matrix. When false, skip the cascade job entirely so callers
    can declare permissions: contents: read.
  type: boolean
  default: true

# tests-passed job
tests-passed:
  if: inputs.cascade
  needs: rake
  ...

Caller templates:

• master/rake.yml → cascade: true (or omit; default), permissions: contents: write
• master/rake_test_only.yml → cascade: false, permissions: contents: read

The matrix job body stays in ONE place. Class (g) registers the caller-template pair, not a second 144-line reusable.

Standing rule

Any new cimas variant or reusable must:

1. Prefer extending an existing reusable via input over shipping a sibling.
2. Register in VARIANT_REGISTRY in the same PR.

Please rework along these lines. Happy to take the rewrite if preferred.

[ronaldtse]

Superseded by #383.

#383 takes the consolidated shape (Option 2 from #362): one reusable with a cascade boolean input, thin caller template for permissions. Rejects the 144-line sibling-reusable duplication.

Standing rule going forward: extend existing reusables via inputs; never ship near-duplicate sibling workflows. Any new cimas variant registers in VARIANT_REGISTRY in the same PR.