ci: add reusable Windows and macOS CLI portability matrix

[ORESoftware]

Purpose

Establish one immutable, least-privilege GitHub Actions contract for actively maintained CLI repositories across the connected organizations.

Matrix

Every caller is tested on:

• ubuntu-24.04
• macos-15
• windows-2025

Rust callers

The reusable workflow validates repository-relative inputs, requires a committed lockfile by default, runs formatting, warnings-denied Clippy, all targets, release builds, and executes every binary with --help. A final assertion proves the workflow did not mutate tracked or untracked source state.

Node callers

The workflow supports npm, pnpm, and Yarn with immutable/frozen installs. It runs available format, lint, typecheck, test, and build scripts, requires at least test or build, executes every package.json#bin entry with --help, and proves a clean checkout.

Security boundary

• contents: read only;
• external Actions pinned by full commit SHA;
• checkout credentials are not persisted;
• caller working directories are resolved and constrained to the repository;
• optional private Git access is supplied only through a dedicated read-only reusable-workflow secret and removed after execution;
• no production credentials, deployment behavior, or package publication is included.

Certification

A companion PR in zed-pkg-test/.github exercises both minimal Rust and Node CLI fixtures across all six language/OS combinations before this workflow is merged. Production callers will pin the resulting merge commit rather than this branch.

The accompanying standard documents path-dependency exceptions, test-org certification, duplicate/empty repository handling, and the ban on chat-supplied personal tokens as CI credentials.

[linear-code]

DEN-3020

[ORESoftware]

Independent test-organization certification is complete at claritas-viz-test/.github#9, head f0539a1ab3de1a1a3f201e5c69f29384e97d61b1.

Run 31269221749 passed all six required jobs:

• Node / Windows Server 2025 — 93132263951;
• Node / macOS 15 — 93132263980;
• Node / Ubuntu 24.04 — 93132263983;
• Rust / macOS 15 — 93132264011;
• Rust / Ubuntu 24.04 — 93132264014;
• Rust / Windows Server 2025 — 93132264017.

Every Rust job passed lockfile validation, formatting, warnings-denied Clippy, all tests, release builds, real executable --help smokes, and the clean-worktree assertion. Every Node job passed immutable npm installation, syntax/lint/test/build scripts, the real CLI entry-point smoke, and the clean-worktree assertion.

Additional production evidence against this exact reusable-workflow head:

• claritas-viz/claritas-cli#1 passed all three operating systems in run 31268806413;
• file-tunnel/ftnl-cli#1 passed all three operating systems in run 31269012712;
• zed-pkg-test/.github#18 passed both Windows language fixtures while its other hosted jobs remained queued.

Repository-local baseline and public-privacy checks are also green at head 5732c20d6741be9faf0c9ec36061ca4cb9f50f97. The workflow is ready to merge and become the immutable fleet pin.

Refs DEN-3020.