ci(gitly): run full macOS ci/macos_ci.vsh set; trigger on master+PR commits

- .gitly-ci.yml: build V, then run the full macos_ci.vsh task set (ordered
  reliable-first; test_symlink omitted as unsafe on a persistent runner).
- macos_gitly_ci.yml: also trigger on pull_request commits; drop concurrency
  cancellation so every commit runs, serialized by the single self-hosted runner.

.github/workflows/macos_gitly_ci.yml

@@ -8,19 +8,26 @@ name: macOS CI (gitly_ci)
 #   * python3 and curl (both ship with macOS)
 #   * a committed .gitly-ci.yml at the repo root describing the steps to run
 #
-# Security: self-hosted runners must not execute untrusted code, so this
-# workflow deliberately does NOT trigger on `pull_request` (fork PRs). It runs
-# only for branches pushed by people with write access, plus manual dispatch.
+# Triggers on every commit to master and every commit to a pull request, so the
+# self-hosted macOS runner runs each one and streams the results back here.
+#
+# SECURITY: this is a self-hosted runner on a public repo, and `pull_request`
+# builds run PR-authored code (including .gitly-ci.yml and ci/*) on the runner
+# machine. Gate fork PRs behind manual approval under
+# Settings > Actions > General > "Fork pull request workflows from outside
+# collaborators" > "Require approval for all external contributors".
+#
+# No `concurrency:` cancellation on purpose: every commit must run. A single
+# self-hosted runner executes one job at a time and queues the rest, so runs are
+# serialized (one macOS CI job at a time) without dropping any commit.
 
 on:
   push:
     branches: [master]
+  pull_request:
+    types: [opened, synchronize, reopened]
   workflow_dispatch:
 
-concurrency:
-  group: macos-gitly-ci-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   macos-gitly-ci:
     runs-on: [self-hosted, macOS, gitly-ci]

.gitly-ci.yml

@@ -1,16 +1,58 @@
-# CI pipeline executed by a local gitly_ci instance on a self-hosted macOS
-# runner (see .github/workflows/macos_gitly_ci.yml). gitly_ci runs each step and
-# streams its output back into the GitHub Actions log in real time.
+# Full macOS CI (ci/macos_ci.vsh), executed by a local gitly_ci instance on a
+# self-hosted macOS runner. gitly_ci runs each step and streams its output back
+# into the GitHub Actions log in real time (.github/workflows/macos_gitly_ci.yml).
 #
-# This is a small, fast, reliable subset of ci/macos_ci.vsh to start with; add
-# more tasks from that file (self_tests, build_examples, sanitizers, ...) as the
-# self-hosted runner is scaled up.
+# V is built from the checked-out source first, then every task runs with that
+# freshly built ./v. Like GitHub Actions, gitly_ci stops at the first failing
+# step, so tasks are ordered reliable-first: the long / environment-heavy ones
+# (build_examples, run_sanitizers, self_tests) run last so a failure there does
+# not hide the rest.
+#
+# `test_symlink` from macos_ci.vsh is intentionally omitted: it repoints the
+# host's /usr/local/bin/v to the ephemeral CI workspace, which is fine on a
+# throwaway CI VM but not on a persistent self-hosted runner.
 jobs:
   macos-clang:
     steps:
+      - name: Build V from source
+        run: make -j4
       - name: v doctor
-        run: v run ci/macos_ci.vsh v_doctor
+        run: ./v run ci/macos_ci.vsh v_doctor
+      - name: Build V using V
+        run: ./v run ci/macos_ci.vsh build_using_v
+      - name: Verify `v test` works
+        run: ./v run ci/macos_ci.vsh verify_v_test_works
+      - name: Build V with -cstrict
+        run: ./v run ci/macos_ci.vsh build_with_cstrict
+      - name: Test cross compilation to Linux
+        run: ./v run ci/macos_ci.vsh test_cross_compilation
+      - name: Test inline assembly
+        run: ./v run ci/macos_ci.vsh test_inline_assembly
+      - name: Test pure V math module
+        run: ./v run ci/macos_ci.vsh test_pure_v_math_module
       - name: Build examples with -prod
-        run: v run ci/macos_ci.vsh build_examples_prod
+        run: ./v run ci/macos_ci.vsh build_examples_prod
       - name: Build tetris with -autofree
-        run: v run ci/macos_ci.vsh build_tetris_autofree
+        run: ./v run ci/macos_ci.vsh build_tetris_autofree
+      - name: Build blog tutorial with -autofree
+        run: ./v run ci/macos_ci.vsh build_blog_autofree
+      - name: Build examples with V compiled with tcc
+        run: ./v run ci/macos_ci.vsh build_examples_v_compiled_with_tcc
+      - name: V self compilation with -parallel-cc
+        run: ./v run ci/macos_ci.vsh v_self_compilation_parallel_cc
+      - name: Test password input
+        run: ./v run ci/macos_ci.vsh test_password_input
+      - name: Test readline
+        run: ./v run ci/macos_ci.vsh test_readline
+      - name: Install iconv for encoding.iconv
+        run: ./v run ci/macos_ci.vsh install_iconv
+      - name: Build V with prealloc
+        run: ./v run ci/macos_ci.vsh build_v_with_prealloc
+      - name: All code is formatted
+        run: ./v run ci/macos_ci.vsh all_code_is_formatted
+      - name: Build examples
+        run: ./v run ci/macos_ci.vsh build_examples
+      - name: Run sanitizers
+        run: ./v run ci/macos_ci.vsh run_sanitizers
+      - name: Self tests
+        run: ./v run ci/macos_ci.vsh self_tests