ci: run quest check on pushes to main, dev, and questlines

.github/workflows/alert.yml

@@ -39,6 +39,7 @@ on:
       - Nightly
       - OBS
       - Platform
+      - Quest
       - release-brew
       - Release Dart
       - Release Dart FFI

.github/workflows/quest.yml

@@ -0,0 +1,58 @@
+name: Quest
+
+# Validates the quest tree on every branch that carries one. check.yml already
+# runs `quest check` on a pull request into any branch, but a direct push (a
+# merge to `main` or `dev`, or `main` merged into a questline) is nobody's pull
+# request, so a broken tree could land there unseen.
+#
+# Push only: a pull request is check.yml's job, and a pull_request trigger here
+# would spawn a skipped Alert run on every push to every pull request.
+#
+# The paths mirror the quest module in sh/dispatch.sh's impact map: the
+# documents, and flake.lock, which pins the validator.
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+      - "quest/**"
+    paths:
+      - "quest/**"
+      - "flake.lock"
+      - ".github/workflows/quest.yml"
+
+# Only the newest push to a branch matters; Alert ignores the cancelled runs.
+concurrency:
+  group: quest-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    # Not `Check`: that is check.yml's required status, and a second job with
+    # the same name would make it ambiguous on a head that runs both.
+    name: Quest
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
+        with:
+          determinate: false
+          # Trust the flake's cachix substituter, which holds the dev shell;
+          # see check.yml.
+          extra-conf: |
+            extra-substituters = https://kixelated.cachix.org
+            extra-trusted-public-keys = kixelated.cachix.org-1:CmFcV0lyM6KuVM2m9mih0q4SrAa0XyCsiM7GHrz3KKk=
+
+      # The whole tree, unscoped: a push has no base to diff against.
+      - name: Check
+        run: nix develop --command quest check

quest/m0/README.md

@@ -46,7 +46,6 @@ Published API or wire breaks still land on dev; each quest's Plan says so.
 - [Subgroup refusal](/quest/m0/ietf-subgroup-refusal.md) - a non-zero moq-transport subgroup costs that one stream, never the session
 - [IETF stream types](/quest/m0/ietf-uni-stream-types.md) - padding streams are discarded stream-only and an unknown uni type closes the session, per draft-21
 - [Request caps](/quest/m0/request-caps.md) - lite message sizes, IETF request IDs, and per-session announces and subscriptions are bounded
-- [quest check everywhere](/quest/m0/quest-check-everywhere.md) - `quest check` guards `main`, `dev`, and the line branches on push and PR, not only PRs into `main`
 - [noq reassembly cap](/quest/m0/noq-reassembly-cap.md) - noq carries quinn's stream reassembly cap and the connection receive window is finite by default
 - [qmux reset race](/quest/m0/qmux-reset-race.md) - qmux handles RESET_STREAM under one lock instead of panicking
 - [Remove gossip](/quest/m0/remove-gossip.md) - a relay dials only configured peers; `cluster.mesh` is refused at startup