← back to Cli Printing Press

ci: add Main CI workflow for post-merge build+test+golden gate (#716)

c9ebffaa349a302138d3cafda7e2ca19465db895 · 2026-05-08 00:59:21 -0700 · Trevin Chow

Adds a workflow that runs build, test, and golden-verify against pushes to
main and PRs targeting main. The post-merge run is the alarm bell on main;
the pull_request run gives a stable check name a branch protection rule
can require ("require branches to be up to date") so a Release PR cannot
merge with a stale view of main.

The existing sharded, change-gated CI in lint.yml stays — it's optimized
for fast PR feedback. This workflow is intentionally redundant as a single
load-bearing signal that catches concurrent-PR merge skew (e.g. one PR
adding a test that a sibling PR violates) the moment main updates.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

• A .github/workflows/main-ci.yml

Diff

commit c9ebffaa349a302138d3cafda7e2ca19465db895
Author: Trevin Chow <trevin@trevinchow.com>
Date:   Fri May 8 00:59:21 2026 -0700

    ci: add Main CI workflow for post-merge build+test+golden gate (#716)
    
    Adds a workflow that runs build, test, and golden-verify against pushes to
    main and PRs targeting main. The post-merge run is the alarm bell on main;
    the pull_request run gives a stable check name a branch protection rule
    can require ("require branches to be up to date") so a Release PR cannot
    merge with a stale view of main.
    
    The existing sharded, change-gated CI in lint.yml stays — it's optimized
    for fast PR feedback. This workflow is intentionally redundant as a single
    load-bearing signal that catches concurrent-PR merge skew (e.g. one PR
    adding a test that a sibling PR violates) the moment main updates.
    
    Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/main-ci.yml | 51 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/.github/workflows/main-ci.yml b/.github/workflows/main-ci.yml
new file mode 100644
index 00000000..54f9a645
--- /dev/null
+++ b/.github/workflows/main-ci.yml
@@ -0,0 +1,51 @@
+name: Main CI
+
+# Runs the full unit-test + golden-verify suite against main and against PRs
+# targeting main. The push trigger is the post-merge alarm; the pull_request
+# trigger lets a branch protection rule require this exact check, so the
+# Release PR (and any other PR) cannot merge with a stale view of main.
+#
+# The existing CI in lint.yml runs sharded, change-gated tests to keep PR
+# turnaround fast. This workflow is intentionally redundant: it reruns the
+# whole suite from scratch as a single load-bearing signal a branch protection
+# rule can pin against.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# cancel-in-progress so a batch of rapid merges only burns CI for the final
+# state. The question this workflow answers is "is main green right now?" —
+# only the latest run matters. Per-merge attribution can be recovered with
+# git bisect if a regression slips through.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Build
+        run: go build ./...
+
+      - name: Test
+        run: go test -timeout 15m ./...
+
+      - name: Verify golden fixtures
+        run: bash scripts/golden.sh verify

← c9dd54ae chore(main): release 4.0.6 (#711)  ·  back to Cli Printing Press  ·  feat(cli): emit AGENTS.md for printed CLIs (fast-track of #6 a9b9aa65 →