From c9a9df99f1bf20995e6cdd2456efac34ea60a05b Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Wed, 22 Jul 2026 11:10:17 +0200 Subject: [PATCH] docs(ci): describe what the CI workflow actually does The header claimed it "runs the full test suite" - it also typechecks the web and MCP projects and fails on drift between rules/guardrails.json and the generated rule files. It also called itself "the gate that decides whether a change is allowed to be correct", which was both garbled and false: main is deliberately unprotected, so a red run reports rather than blocks. Comment only, no behaviour change. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e13f112e..9ee002e1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,8 +1,12 @@ name: CI -# Runs the full test suite on every pull request and every push to main. -# The deploy workflows build but do not test — this is the gate that decides -# whether a change is allowed to be correct. +# Tests, typechecks and drift-checks every push to main and every pull request: +# the .NET suites, the web and MCP suites, and a guard that the generated rule +# files still match rules/guardrails.json. +# +# The deploy workflows build but never test, so this is the only place the suites +# actually run. It does not gate anything — main is deliberately unprotected, so a +# red run reports rather than blocks. Read the result and follow up. on: push: