From 0c78df5128fbdc2011b6cf96b7ef4055019c9778 Mon Sep 17 00:00:00 2001 From: Mathias Date: Mon, 5 Oct 2026 07:13:23 +0200 Subject: [PATCH] ci: run the check job on pull requests A PR never got a CI run: the workflow triggered only on push to main and on tags, so the risk/medium+ PR lane merged on local task check alone (PR #66). pull_request now runs Lint/Test/Vet on the PR head; build is gated to push and deploy already was, so a PR builds no image, writes nothing to infra and sees no secrets. Closes #68 Co-Authored-By: Claude Opus 5.5 --- .gitea/workflows/cd.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml index 5f78fdd..24158a9 100644 --- a/.gitea/workflows/cd.yml +++ b/.gitea/workflows/cd.yml @@ -8,6 +8,12 @@ name: CD # (Only applies to branch pushes; tag pushes always trigger.) paths-ignore: - 'docs/**' + # gitea-mcp#68: without this a PR never got a CI run, so the risk/medium+ + # PR lane merged on local `task check` alone. Only the check job runs for a + # PR -- build and deploy stay push/tag-only (no images, no infra writes, + # no secrets from a PR). + pull_request: + branches: [main] env: IMAGE: gitea-mcp @@ -44,6 +50,7 @@ jobs: build: name: Build & Import needs: check + if: github.event_name == 'push' runs-on: self-hosted outputs: image-tag: ${{ steps.meta.outputs.sha-tag }}