Skip to content

Run continuous CI on main pushes and pull requests - #47

Merged
danielchalmers merged 1 commit into
mainfrom
claude/github-workflows-audit-9fe72c
Jul 27, 2026
Merged

Run continuous CI on main pushes and pull requests#47
danielchalmers merged 1 commit into
mainfrom
claude/github-workflows-audit-9fe72c

Conversation

@danielchalmers

@danielchalmers danielchalmers commented Jul 27, 2026

Copy link
Copy Markdown
Member

continuous.yml triggers on on: [push] with no pull_request trigger. A push event never fires for a pull request opened from a fork, so fork PRs land in review with no CI at all — nothing compiled, nothing format-checked.

The same trigger also causes the opposite problem: [push] matches every branch and every tag, so internal branch pushes burn runner time, and a release tag push runs continuous and release concurrently over the same commit.

Change

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

This matches the trigger shape already used by MudBlazor/MudBlazor (build-test-mudblazor.yml) and MudBlazor/TryMudBlazor (build-test-trymudblazor.yml).

Because the workflow is generated from the NUKE [GitHubActions] attribute, build/Build.cs is updated in the same commit so a future regeneration doesn't silently revert the trigger. NUKE rejects mixing shorthand On with the expanded On* properties, so both push and pull_request are branch-scoped via OnPushBranches/OnPullRequestBranches.

Interaction with #46

#46 removes NUKE and hand-writes both workflows. If that lands first, this PR needs a trivial rebase: keep the on: block, drop the build/Build.cs hunk. If this lands first, #46 should carry the new on: block forward into its rewritten continuous.yml.

Worth noting for #46's case: restoring the NUKE build project surfaced System.Security.Cryptography.Xml 9.0.0 with seven known high-severity advisories and NuGet.Packaging 6.12.1 with one low, pulled in transitively via Nuke.Common.

The `continuous` workflow triggered on `push` only, which never fires for
pull requests opened from forks. Five of the last fifteen PRs to this repo
came from forks, so none of them were compiled or format-checked before
review.

Scope the push trigger to `main` and add a `pull_request` trigger, matching
what MudBlazor/MudBlazor and MudBlazor/TryMudBlazor already do. As a side
effect this also stops `continuous` from running on every internal branch
push and on tag pushes, where it duplicated work already done by `release`.

The trigger is declared in the NUKE `[GitHubActions]` attribute, so
`build/Build.cs` is updated alongside the generated YAML to keep the two in
sync.
@danielchalmers
danielchalmers merged commit 59dddac into main Jul 27, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant