ci.yml

name: CI
on:
  push:
    branches: [main]
  pull_request:
permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
jobs:
  checks: # name kept as "checks" to satisfy the repository's required-status-check ruleset
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false # no step pushes back to the repository
      - name: Install mise toolchain
        uses: jdx/mise-action@v4
        with:
          cache: true
      - name: Run canonical gate
        run: mise run all
      - name: Verify no changes
        run: test -z "$(git status --porcelain)"