ci: run one pipeline per push to main

[altaywtf]

Problem

main.yml and release.yml both triggered on push to main, and each defined
its own verify job and its own caller of
uinaf/.github scan.yml.
Every push ran the entire gate twice. Check-runs on the previous main tip
1c690ea
show it: verify twice and each of the four scan / * contexts twice, across
run 34638081028 and
run 34638081165 —
8 scan jobs, each a fetch-depth: 0 clone plus a Docker pull, and a duplicated
full vp run ready.

Solution

The shape already proven in
uinaf/design:
one push pipeline in release.yml, the file npm Trusted Publishing binds to.

• verify is now uses: ./.github/workflows/verify.yml — the same definition
  that guards pull requests, so the push gate cannot drift from it. verify.yml
  gains workflow_call and design's cancel-in-progress: ${{ github.event_name == 'pull_request' }}, because a superseded push run is
  the one deploy and release need.
• scan is declared once.
• deploy moved here from main.yml and is a sibling of release; both are
  on needs: [verify, scan]. main.yml is deleted.
• The deploy job carries permissions: contents: read explicitly, since
  release.yml is permissions: {} where main.yml granted it workflow-wide.
• main.yml's concurrency: main-${{ github.repository }} came along.

De-duplication, not a rewrite: the release job is byte-identical to its previous
form, and the deploy job differs only by the two added permissions lines.

Proof

• deploy never waits on release: the two are siblings, both needs: [verify, scan], asserted by parsing the workflow rather than reading it.
• Required contexts are untouched. They come from verify.yml (job verify) and
  scan.yml (job scan) on pull_request, and neither job was renamed. This
  PR's own checks are the live proof.
• actionlint clean; zizmor 1.29.0 (the version the shared scan pins) reports
  no findings; vp fmt --check passes.

Before: 12 check-runs per push over 2 workflow runs. After: 7 over 1.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

🟢 Approval recommended

The consolidation cleanly removes duplicated push-to-main CI while preserving the existing required contexts and keeping deploy independent from release.

Pull request overview

This PR de-duplicates CI on pushes to main by consolidating the push pipeline into .github/workflows/release.yml, reusing the same verify definition that guards PRs, and deleting the redundant main.yml workflow.

Changes:

• Make .github/workflows/verify.yml reusable via workflow_call and adjust concurrency cancellation to avoid canceling superseded push-to-main gates.
• Move the push-to-main gate (verify, scan, deploy) into .github/workflows/release.yml so only one pipeline runs per commit.
• Update docs to reflect that pushes to main now run via release.yml (and remove references to main.yml).

File summaries

File	Description
docs/releasing.md	Updates release documentation to reflect a single push-to-main workflow pipeline in release.yml.
docs/deploy.md	Updates deploy documentation to reference release.yml instead of main.yml.
.github/workflows/verify.yml	Adds workflow_call so the same verify job definition is shared across PRs and push-to-main.
.github/workflows/release.yml	Consolidates push-to-main verify/scan/deploy alongside the existing release job under one workflow.
.github/workflows/main.yml	Deletes the redundant push-to-main workflow to prevent duplicate CI runs.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.