ci.yml

name: CI

on:
  push:
    # `pricing-review` is here because the pull_request event never fires for
    # that branch, and the reason is not obvious.
    #
    # GitHub deliberately does not trigger workflows for events created with
    # `GITHUB_TOKEN`, to stop a workflow triggering itself forever. The daily
    # sync opens its review pull requests with that token, so those PRs arrive
    # carrying only the checks that run on their own schedule — CodeQL — and
    # none of `verify`. The one class of change where catalog validation matters
    # most was the one class arriving unvalidated.
    #
    # Found on 2026-08-04, on a pricing PR that had to be verified by hand
    # before it could be merged. Triggering on the branch push instead sidesteps
    # the token restriction entirely and needs no credentials, where the
    # alternative — a fine-grained PAT passed to the action — needs a secret
    # that can open pull requests.
    #
    # The branch name must track sync-pricing.yml's `branch:` value exactly —
    # `pricing-sync/**` never matched the actual `pricing-review` branch that
    # workflow pushes to, so this trigger silently never fired. Found on
    # 2026-08-19 when PR #77 merged carrying only CodeQL, no `verify`.
    branches: [main, pricing-review]
  pull_request:
  # A manual handle on the same gate.
  #
  # Twice now a pull request has arrived carrying only CodeQL and none of
  # `verify` — see the note above on GITHUB_TOKEN, and PR #77 on 2026-08-19.
  # Both times the fix was to make some *other* event fire. That works only once
  # the cause is known, and the symptom is silent: a green pull request that was
  # never actually verified looks exactly like one that was.
  #
  # `workflow_dispatch` removes the dependency on diagnosing the cause. Whatever
  # swallowed the event, the gate can still be pointed at the branch by hand from
  # the Actions tab, and its result read before merging.
  workflow_dispatch:

# Least privilege for GITHUB_TOKEN. Without this block a job inherits the
# repository default, which is broader than anything here needs — nothing in the
# verify gate writes to the repository, opens a pull request or publishes.
#
# CodeQL's hint for this file is an empty block, and that is one step too far: a
# reusable workflow's permissions are capped by its caller, so granting nothing
# here would leave `verify.yml` unable to check out the code it exists to test.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # A single reusable gate. Both CI and the Pages deploy call this same job, so
  # there is exactly one definition of "verified" and no way to ship past it.
  verify:
    uses: ./.github/workflows/verify.yml