From 7fc534b1de478d7ba504fc74f8a733085b6e99bc Mon Sep 17 00:00:00 2001 From: Benjamen Keroack Date: Tue, 6 Oct 2026 10:57:53 -0600 Subject: [PATCH] ci: run Tests and Lint on pushes to release branches ci.yml ran on pull requests and on pushes to master only, so nothing tested release/0.6 after a merge. A PR is tested as head-merged-into-base at event time, and an --admin merge can land on top of a fix that merged after that run, so the 0.6.x branch could reach a tag with a combination no CI run had built. Pushes to release/** now get the same Tests and Lint run as master pushes. seed-cache stays master-only, and push runs are still never cancelled. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/ci.yml | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f05e2c60..7c227653 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,30 +1,33 @@ name: CI -# Build + test + lint, on pull requests and on every push to master. Runs on -# GitHub-hosted runners so that untrusted fork PRs cannot execute arbitrary -# code on a maintainer-owned self-hosted machine. Tag-cut release builds live -# in `release.yml` (also hosted); reproducible-build verification lives in -# `nix.yml`. +# Build + test + lint, on pull requests and on every push to master or a +# release branch. Runs on GitHub-hosted runners so that untrusted fork PRs +# cannot execute arbitrary code on a maintainer-owned self-hosted machine. +# Tag-cut release builds live in `release.yml` (also hosted); reproducible-build +# verification lives in `nix.yml`. # -# `Tests` and `Lint` run on master pushes as well as PRs, and deliberately so. -# A PR is tested as head-merged-into-base at event time, which is not the tree -# the merge actually produces; and a merge that outruns its own checks — or -# bypasses them — leaves nothing else to notice. Master went two days with a -# tree that did not compile because the only master-push job was `seed-cache`, -# and it was found by an unrelated PR rather than by CI. These two jobs are -# the detection net for that. +# `Tests` and `Lint` run on master and release-branch pushes as well as PRs, +# and deliberately so. A PR is tested as head-merged-into-base at event time, +# which is not the tree the merge actually produces; and a merge that outruns +# its own checks — or bypasses them — leaves nothing else to notice. Master +# went two days with a tree that did not compile because the only master-push +# job was `seed-cache`, and it was found by an unrelated PR rather than by CI. +# These two jobs are the detection net for that. Patch releases are tagged +# from a `release/*` branch, so the fixes merged there get the same net. on: push: branches: - master + - 'release/**' pull_request: types: [opened, synchronize, reopened] # Cancel superseded runs on the same PR. Avoids burning hosted-runner # minutes on stale commits when a contributor pushes rapid fixups. # -# Cancellation is scoped to pull requests. Master pushes share one ref, so a +# Cancellation is scoped to pull requests. Master pushes share one ref (as do +# a release branch's), so a # blanket `cancel-in-progress` made each merge cancel the post-merge # verification of the merge before it — and merges routinely land minutes # apart. The `seed-cache` job that runs on master is the only thing that