Repository navigation
ci: draft gate, per-run main concurrency, pinned security scan - #2
Merged
Shahrum Amiri (ShahrumAmiri) merged 2 commits intoOct 24, 2026
Merged
Conversation
- pull_request now listens for ready_for_review, and a first "Draft gate" step fails draft runs red so the full suite runs once, when the PR is ready. - Pushes to main each get their own concurrency group instead of queueing. - The security job pins gitleaks to a constant SHA-256 (it used to trust a checksums file fetched beside the tarball), scans history reachable from HEAD plus the working tree, fails closed on a shallow clone, and adds a semgrep SAST pass. - docs/adr/conventions.md: how the decision log is kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the generated docs/adr/conventions.md and neutralize one comment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
pull_requestnow also fires onready_for_review, and the lint job's first step fails a draft run red. The full suite runs once, when the PR is ready.ci-main-run-<run_id>), so main runs no longer queue behind each other. PR refs still cancel superseded runs.The job names are unchanged (
Lint & syntax check,security), so the required checks still match.Verify
CI on this PR runs the new security steps for the first time. If semgrep reports an ERROR-level finding in existing code, it goes red here before anything merges.
🤖 Generated with Claude Code