[mattbodle]

Background

• The pull-request workflow currently packages Rokt.Widget and builds both Android and iOS for every change. In the audit sample, 8 of 21 merged PRs were CI-only and another 4 of 21 were Android-only, so more than half could avoid either both platform builds or the unrelated iOS build.
• Current Dependabot PRs can complete platform validation and still finish red when Google Chat cannot read the repository webhook secret. Notification transport communicates a result; it is not a validation result and should not block merging.
• A required workflow cannot safely use top-level path filters because GitHub can leave the required check pending when the workflow is skipped. The workflow therefore remains always triggered, selects jobs with job-level conditions, and reports one aggregate gate that always runs.
• Reduced CI must fail closed. Workflow, composite-action, dependency, Trunk, release contract, unknown, renamed, copied, empty-diff, hotfix, and release changes all require the complete pipeline.

What Has Changed

• Add a repository-owned classifier and a 23-check shell spec. It distinguishes documentation/metadata, Android native code, iOS native code, shared package/plugin code, sample/Expo apps, and full-build contracts.
• Keep the existing workflow and validation job names while adding job-level selection:
  • docs and safe metadata: Trunk only;
  • Rokt.Widget/android/**: package plus Android;
  • Rokt.Widget/ios/**: package plus iOS;
  • shared TypeScript, package/plugin configuration, sample apps, or mixed native platforms: package plus Android and iOS;
  • workflow/build/dependency, sensitive contracts, unknown paths, renames, copies, unreadable or empty diffs: full.
• Add an if: always() PR Gate that verifies the classifier, Trunk, package, Android, and iOS results against the selected plan. Skipped jobs are accepted only when the classifier explicitly did not select them.
• Make Google Chat Dependabot-aware and non-blocking. Dependabot skips the notification entirely; human PRs use the same pinned Google Chat action with continue-on-error, after the PR gate has already passed.
• Add anchored ownerless CODEOWNERS exceptions for safe root documentation, repository metadata, the PR template, and app README files. Explicitly restore SDK-team ownership for security/release/agent contracts, workflows, composite actions, selector scripts, Trunk, dependency automation, package manifests, plugin/podspec inputs, and native dependency locks.
• Group GitHub Actions and Gradle patch/minor Dependabot updates separately. Major updates remain individual PRs, and the existing Gradle ignore policy remains unchanged.

Screenshots/Video

• {Include any screenshots or video demonstrating the new feature or fix, if applicable}

Checklist

• I have performed a self-review of my own code.
• I have made corresponding changes to the documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have tested this locally.

Additional Notes

• bash .github/scripts/select-pr-jobs.spec.sh — 23 checks, 0 failures.
• The committed workflow/dependency diff selects full, so this PR cannot reduce its own validation.
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/pull-request.yml passed.
• Trunk reported no issues across all five changed files, both locally and in the pre-push hook.
• bash -n passed for both classifier scripts; Ruby parsed the workflow and Dependabot YAML; git diff --check passed.
• npm ci, npm run lint, npm run build, and npm run build:plugin passed in Rokt.Widget. The install still reports the repository's existing dependency audit findings; this PR does not change the npm graph.
• No repository setting was changed. After representative docs-only, Android-only, and iOS-only probes pass, administrators can require PR Gate, enable auto-merge, and enable update-branch support. Existing job names remain available during the transition.

Co-Authored-By: Codex noreply@openai.com

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[paved-road-agent]

🛣️ Rokt Platform Paved Roads Scan Complete

✅ No paved-road issues detected

Scanned files against 188 rules. · Reviewed commit: 38d96370e4

📜 Scan history (2 scans)

Commit	Time (UTC)	Status	Findings
38d9637	2026-08-27 01:19:25	✅ success	0
0fdd7c8	2026-08-27 00:24:29	✅ success	0

ℹ️ About Rokt Platform Paved Roads Agent

This scan was performed by the Rokt Platform Paved Roads Agent, an automated paved-road standards review tool for pull requests. See the User Guide for details on severity levels, feedback reactions, and scan configuration.

Reply @paved-road-agent help for the list of commands you can run on this PR.

[pr-security-agent]

🔒 Security Scan Complete

✅ No security issues detected

Scanned files against 88 rules. · Reviewed commit: 38d96370e4

📜 Scan history (2 scans)

Commit	Time (UTC)	Status	Findings
38d9637	2026-08-27 01:19:25	✅ success	0
0fdd7c8	2026-08-27 00:24:30	✅ success	0

ℹ️ About PR Security Agent

This scan was performed by PR Security Agent, an automated security review tool for pull requests. See the User Guide for details on severity levels, feedback reactions, and scan configuration.

Reply @pr-security-agent help for the list of commands you can run on this PR.

[nickolas-dimitrakas]

Reviewed — CI green, no open questions. Approving so this can merge directly.