[CI] PR Policy thin caller for reusable workflow (2025.4)

.github/workflows/composer-outdated-check-latest.yaml

@@ -29,7 +29,7 @@ jobs:
             fail-fast: false
             matrix:
                 include:
-                    - { php-version: 8.4, branch: prepare-2025.x }
+                    - { php-version: 8.4, branch: 2025.4 }
         with:
             php-version: ${{ matrix.php-version }}
             branch: ${{ matrix.branch }}

.github/workflows/new-docs.yml → .github/workflows/docs.yml

@@ -1,14 +1,14 @@
 name: "Documentation (Reusable)"
 
 on:
-  pull_request_target:
+  pull_request:
     branches:
       - "[0-9]+.[0-9]+"
       - "[0-9]+.x"
       - "docs_actions"
     paths:
       - "doc/**"
-      - ".github/workflows/new-docs.yml"
+      - ".github/workflows/docs.yml"
       - "README.md"
   push:
     branches:
@@ -17,16 +17,14 @@ on:
       - "docs_actions"
     paths:
       - "doc/**"
-      - ".github/workflows/new-docs.yml"
+      - ".github/workflows/docs.yml"
       - "README.md"
 
 permissions:
   contents: read
 
 jobs:
   docs:
-    uses: pimcore/workflows-collection-public/.github/workflows/reusable-docs.yaml@reusable-workflows
+    uses: pimcore/workflows-collection-public/.github/workflows/reusable-docs.yaml@main
     with:
       docs_path: "doc"
-    secrets:
-      DOCS_GENERATOR_ACCESS_TOKEN: ${{ secrets.DOCS_GENERATOR_ACCESS_TOKEN }}

.github/workflows/osv-checks.yaml

@@ -17,10 +17,8 @@ jobs:
             fail-fast: false
             matrix:
                 include:
-                    - { php-version: 8.1, platform-version: 'v2022.0' }
-                    - { php-version: 8.2, platform-version: 'v2023.3' }
                     - { php-version: 8.3, platform-version: 'v2024.4' }
-                    - { php-version: 8.4, platform-version: '2025.x' }
+                    - { php-version: 8.4, platform-version: 'v2025.4' }
         with:
             php-version: ${{ matrix.php-version }}
             platform-version: ${{ matrix.platform-version }}

.github/workflows/pr-policy.yml

@@ -0,0 +1,30 @@
+name: PR Policy
+
+# Thin caller — the policy logic lives in
+# pimcore/workflows-collection-public/.github/workflows/reusable-pr-policy.yml
+# and changes there apply automatically. Make the "PR Policy / Milestone assigned"
+# check required (repo ruleset / branch protection) so it actually blocks merging.
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+      - milestoned
+      - demilestoned
+      - labeled
+      - unlabeled
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-policy-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  pr-policy:
+    name: PR Policy
+    uses: pimcore/workflows-collection-public/.github/workflows/reusable-pr-policy.yml@main