From 5c5bca2b1c389bbfd45edf25a2475f8177c30b53 Mon Sep 17 00:00:00 2001 From: Noah Schatz Date: Tue, 20 Oct 2026 01:29:47 +0000 Subject: [PATCH] Run CI nightly on main, and start it by hand ci.yml gets a schedule trigger, cron "27 5 * * *" (05:27 UTC, an odd minute because GitHub delays scheduled runs at the start of every hour), and workflow_dispatch. push and pull_request stay as they are. The actionlint job now passes reviewdog's reporter by event: the action's default github-pr-check on a pull request, github-annotations on every other event. A schedule event's payload has no repository, so the check reporter in reviewdog 0.21.2 posts to repos///check-runs, gets a 404 and exits 1 (its log-annotation fallback covers a 403 only), which would make every nightly run red. github-annotations writes the same annotations without the API call; a push already produced that output through the 403 fallback, since this token has no checks: write. Harness-Task: 40 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3b40d38..379e7c3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,10 @@ on: branches: [main] pull_request: branches: [main] + schedule: + # The nightly run on main, 05:27 UTC. An odd minute: GitHub delays scheduled runs at the start of every hour. + - cron: "27 5 * * *" + workflow_dispatch: concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -153,7 +157,16 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + # THE REPORTER IS `github-pr-check` (the action's default) ONLY ON A PULL REQUEST. A `schedule` + # event's payload carries no `repository`, so reviewdog 0.21.2's check reporter creates its + # check run at `repos///check-runs`, gets a 404, and exits 1: its fallback to log annotations + # covers a 403 only (reviewdog/reviewdog#832). Every nightly run would be red. On every other + # event `github-annotations` writes the same annotations without the API call. A push already + # ended in that output, by the 403 fallback (this token has no `checks: write`), and sharing + # the reporter with `workflow_dispatch` lets a dispatched run prove the nightly path. - uses: reviewdog/action-actionlint@v1 + with: + reporter: ${{ github.event_name == 'pull_request' && 'github-pr-check' || 'github-annotations' }} # Prove the publish pipeline on every push/PR WITHOUT burning a version (REL-PIPE). No registry # auth, no upload: `publish --dry-run` exercises the publish command path (the release itself