Skip to content

ci(gate): run verify on pushes to main, not only pull requests #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
NCHILLC merged 3 commits into from
Sep 7, 2026
Merged

ci(gate): run verify on pushes to main, not only pull requests #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
28911d9
ci(gate): run verify on pushes to main, not only pull requests
NCHILLC Sep 7, 2026
6c40fd6
docs(ci): say which gate reports and which one blocks
NCHILLC Sep 7, 2026
5b5ab5c
Merge branch 'main' into ci/verify-on-push-to-main
NCHILLC Sep 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,11 @@ name: CI
# the fact is to open a throwaway PR, which means adding a commit to main in
# order to test main.
on:
# Both triggers are load-bearing. `pull_request` gates the merge; `push` to
# main gates commits that never opened a PR — which is how 47 commits reached
# this fork's main without `verify` ever running (2026-09-07).
push:
branches: [main]
pull_request:
branches: [master, main]
workflow_dispatch:
Expand Down
9 changes: 7 additions & 2 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,7 +289,7 @@ DB design policies (2026-06-04 DBA review). These apply to ALL new tables/column

## Quality gates

Pre-commit and CI run the same logical checks; CI's `verify` job is the authoritative gate (wire it up as a required status check). The pre-commit hook is a fast local guard. Mechanism, steps, and Node version are aligned across the superproject and the portal/cms submodules.
Pre-commit and CI run the same logical checks. CI's `verify` job is the authoritative REPORT, and pre-commit is the only thing that actually BLOCKS — see below for why the two are not the same here. Mechanism, steps, and Node version are aligned across the superproject and the portal/cms submodules.

**Run the gates BEFORE writing, not at commit.** `npm run lint:gates` is the
20-gate pre-commit rung and takes seconds. Paying it up front tells you straight
Expand All @@ -314,7 +314,12 @@ An absolute path in `launch.json` does not save you; the launcher rebases it.

**`--no-verify` is blocked**, with `--dangerously-skip-permissions` and
`HUSKY=0`, by a PreToolUse hook (`~/.claude/hooks/block-verify-skip.mjs`).
Pushing runs no CI here, so pre-commit is the only automatic gate that exists.
CI does run now — `verify` fires on pull requests and on pushes to `main`
(2026-09-07) — but it **cannot block a merge on this plan**. Branch protection
and rulesets are unenforced on a private repository under GitHub Free; the
`verify` ruleset on `NCHILLC/OpenInspection` exists and is inert, and goes live
only if the org moves to Team. So a red `verify` is a signal you have to choose
to honour, and **pre-commit remains the only gate that actually stops anything**.
If a gate fails, fix the cause.

- **Hook mechanism**: `.githooks/pre-commit`, activated by the `prepare` npm script (`git config core.hooksPath .githooks`) on `npm install`/`npm ci` — native git hooks, **no husky**.
Expand Down
Loading