This repo's workflows trigger only on push to main and on tags. A pull request therefore never gets a CI run. The gatekeeper merged #66 with a local task check (exit 0) as its gate, and the harness flagged that as a CI bypass. CI after the merge (run 9316) was green, but that green came after the merge, not before it.
So the PR lane that rule 5 requires for risk/medium+ work has no CI on the change it is reviewing. That matters most here, because gitea-mcp is the write path the rest of the estate uses to reach Gitea.
Fix: add pull_request to the CI workflow's triggers, for the jobs that need no secrets (lint, vet and test). Keep the build and deploy jobs on push and tags only.
Done when: a PR shows a CI run on its head sha before it merges.
Other repos may have the same gap. Worth a grep across .gitea/workflows for workflows that have no pull_request trigger.
Found on 2026-10-04 while merging PR #66 (#65).
This repo's workflows trigger only on `push` to main and on tags. A pull request therefore never gets a CI run. The gatekeeper merged #66 with a local `task check` (exit 0) as its gate, and the harness flagged that as a CI bypass. CI after the merge (run 9316) was green, but that green came after the merge, not before it.
So the PR lane that rule 5 requires for risk/medium+ work has no CI on the change it is reviewing. That matters most here, because gitea-mcp is the write path the rest of the estate uses to reach Gitea.
**Fix:** add `pull_request` to the CI workflow's triggers, for the jobs that need no secrets (lint, vet and test). Keep the build and deploy jobs on push and tags only.
**Done when:** a PR shows a CI run on its head sha before it merges.
Other repos may have the same gap. Worth a grep across `.gitea/workflows` for workflows that have no `pull_request` trigger.
---
_Created via git-mcp on behalf of @mathias_
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found on 2026-10-04 while merging PR #66 (#65).
This repo's workflows trigger only on
pushto main and on tags. A pull request therefore never gets a CI run. The gatekeeper merged #66 with a localtask check(exit 0) as its gate, and the harness flagged that as a CI bypass. CI after the merge (run 9316) was green, but that green came after the merge, not before it.So the PR lane that rule 5 requires for risk/medium+ work has no CI on the change it is reviewing. That matters most here, because gitea-mcp is the write path the rest of the estate uses to reach Gitea.
Fix: add
pull_requestto the CI workflow's triggers, for the jobs that need no secrets (lint, vet and test). Keep the build and deploy jobs on push and tags only.Done when: a PR shows a CI run on its head sha before it merges.
Other repos may have the same gap. Worth a grep across
.gitea/workflowsfor workflows that have nopull_requesttrigger.Created via git-mcp on behalf of @mathias