Skip to content

ci(gate): run verify on pushes to main, not only pull requests - #1

Merged
NCHILLC merged 3 commits into
mainfrom
ci/verify-on-push-to-main
Sep 7, 2026
Merged

NCHILLC merged 3 commits into
mainfrom
ci/verify-on-push-to-main

Conversation

@NCHILLC

@NCHILLC NCHILLC commented Sep 7, 2026

Copy link
Copy Markdown
Owner

Summary

ci.yml triggered on pull_request alone, so a commit that never opened a PR was never gated. Forty-seven commits reached this fork's main that way and verify has run against none of them. Adds push: branches: [main] alongside the existing triggers.

This PR is also the mechanism for the second half of the problem: branch protection cannot require a status check it has never seen, so the empty required-checks box on main was a symptom of the same gap. Once this PR's run completes, verify becomes a name GitHub knows and can be added as a required check.

Type of change

  • Refactor / chore (no user-visible change)

Test plan

  • Pre-commit gates green (20/20 selected)
  • verify reports on this PR — that result is the test

Notes

  • Trade-off accepted: pushes to main and PRs both run, roughly doubling billed runner-minutes on merges. concurrency with cancel-in-progress still de-duplicates superseded runs on the same ref.
  • Per the maintainer note in the PR template: merge, do not squash.

Follow-ups (not in this PR)

  • Add verify under Settings → Branches → branch protection once this run finishes.
  • Decide on "Require a pull request before merging". With required status checks and no PR requirement, a fresh commit pushed straight to main is rejected for carrying no passing check.
  • Leave "Require actions to be pinned to a full-length commit SHA" off until every uses: across ci.yml, codeql.yml and release-please.yml is pinned to a SHA — all ~30 are currently tag-pinned and would fail immediately.

🤖 Generated with Claude Code

NCHILLC and others added 3 commits September 7, 2026 07:45
The workflow triggered on `pull_request` alone, so a commit that never
opened a PR was never gated. Forty-seven commits reached this fork's main
that way and `verify` has run against none of them.

Branch protection cannot require a check it has never seen, so the empty
required-checks box was a symptom of the same gap: no run, no name.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CLAUDE.md claimed `verify` was the authoritative gate and, two paragraphs
later, that pushing runs no CI at all. Both are now wrong in different
directions, and a session reading either one acts on it.

CI runs as of the trigger change in this branch. It still cannot block a
merge: branch protection and rulesets are unenforced on a private repo
under GitHub Free, so the `verify` ruleset exists and is inert until the
org moves to Team. Pre-commit stays the only gate that stops anything.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@NCHILLC
NCHILLC merged commit 52e4cde into main Sep 7, 2026
17 checks passed
@NCHILLC
NCHILLC deleted the ci/verify-on-push-to-main branch September 7, 2026 19:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant