From 28911d9b65fe21f54da2c379151ecb45e99970a6 Mon Sep 17 00:00:00 2001 From: Aaron Scott Date: Mon, 7 Sep 2026 07:45:51 -0400 Subject: [PATCH 1/2] ci(gate): run verify on pushes to main, not only pull requests The workflow triggered on `pull_request` alone, so a commit that never opened a PR was never gated. Forty-seven commits reached this fork's main that way and `verify` has run against none of them. Branch protection cannot require a check it has never seen, so the empty required-checks box was a symptom of the same gap: no run, no name. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3d58637c..9a04a8e2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,6 +43,11 @@ name: CI # the fact is to open a throwaway PR, which means adding a commit to main in # order to test main. on: + # Both triggers are load-bearing. `pull_request` gates the merge; `push` to + # main gates commits that never opened a PR — which is how 47 commits reached + # this fork's main without `verify` ever running (2026-09-07). + push: + branches: [main] pull_request: branches: [master, main] workflow_dispatch: From 6c40fd64022fd393b1b6ce3cb4c6b96b4ce067fe Mon Sep 17 00:00:00 2001 From: Aaron Scott Date: Mon, 7 Sep 2026 08:01:47 -0400 Subject: [PATCH 2/2] docs(ci): say which gate reports and which one blocks CLAUDE.md claimed `verify` was the authoritative gate and, two paragraphs later, that pushing runs no CI at all. Both are now wrong in different directions, and a session reading either one acts on it. CI runs as of the trigger change in this branch. It still cannot block a merge: branch protection and rulesets are unenforced on a private repo under GitHub Free, so the `verify` ruleset exists and is inert until the org moves to Team. Pre-commit stays the only gate that stops anything. Co-Authored-By: Claude Opus 5 --- CLAUDE.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 55f926b9..c5182b69 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -289,7 +289,7 @@ DB design policies (2026-06-04 DBA review). These apply to ALL new tables/column ## Quality gates -Pre-commit and CI run the same logical checks; CI's `verify` job is the authoritative gate (wire it up as a required status check). The pre-commit hook is a fast local guard. Mechanism, steps, and Node version are aligned across the superproject and the portal/cms submodules. +Pre-commit and CI run the same logical checks. CI's `verify` job is the authoritative REPORT, and pre-commit is the only thing that actually BLOCKS — see below for why the two are not the same here. Mechanism, steps, and Node version are aligned across the superproject and the portal/cms submodules. **Run the gates BEFORE writing, not at commit.** `npm run lint:gates` is the 20-gate pre-commit rung and takes seconds. Paying it up front tells you straight @@ -314,7 +314,12 @@ An absolute path in `launch.json` does not save you; the launcher rebases it. **`--no-verify` is blocked**, with `--dangerously-skip-permissions` and `HUSKY=0`, by a PreToolUse hook (`~/.claude/hooks/block-verify-skip.mjs`). -Pushing runs no CI here, so pre-commit is the only automatic gate that exists. +CI does run now — `verify` fires on pull requests and on pushes to `main` +(2026-09-07) — but it **cannot block a merge on this plan**. Branch protection +and rulesets are unenforced on a private repository under GitHub Free; the +`verify` ruleset on `NCHILLC/OpenInspection` exists and is inert, and goes live +only if the org moves to Team. So a red `verify` is a signal you have to choose +to honour, and **pre-commit remains the only gate that actually stops anything**. If a gate fails, fix the cause. - **Hook mechanism**: `.githooks/pre-commit`, activated by the `prepare` npm script (`git config core.hooksPath .githooks`) on `npm install`/`npm ci` — native git hooks, **no husky**.