From c3f8d6c0025f14bf33827a3ac69a8670408c0e71 Mon Sep 17 00:00:00 2001
From: Mathias <mthbqv@gmail.com>
Date: Mon, 5 Oct 2026 07:25:38 +0000
Subject: [PATCH] ci: run the check job on pull requests (#68) (#69)

Co-authored-by: Mathias <mthbqv@gmail.com>
---
 .gitea/workflows/cd.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 5f78fdd..24158a9 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -8,6 +8,12 @@ name: CD
     # (Only applies to branch pushes; tag pushes always trigger.)
     paths-ignore:
       - 'docs/**'
+  # gitea-mcp#68: without this a PR never got a CI run, so the risk/medium+
+  # PR lane merged on local `task check` alone. Only the check job runs for a
+  # PR -- build and deploy stay push/tag-only (no images, no infra writes,
+  # no secrets from a PR).
+  pull_request:
+    branches: [main]
 
 env:
   IMAGE: gitea-mcp
@@ -44,6 +50,7 @@ jobs:
   build:
     name: Build & Import
     needs: check
+    if: github.event_name == 'push'
     runs-on: self-hosted
     outputs:
       image-tag: ${{ steps.meta.outputs.sha-tag }}