ci: rename the build job to verify and run it on pull requests - #1
Conversation
Fleet-wide convention: the one status check branch protection names is verify. The build only ran on a push to main, so nothing gated a pull request; it now runs there too and stops before deploy, which stays a push-to-main step. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D6peoaf9UhhfLpnPbuiZbb
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟡 Changes recommended
The PR-triggered verify job inherits write permissions and deployment credentials that must be scoped to the deployment job.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Renames the build job to verify and adds pull-request validation while keeping deployment restricted.
Changes:
- Adds pull-request triggering for
main. - Renames
buildtoverify. - Gates deployment on
verifyand skips it for pull requests.
File summaries
| File | Summary |
|---|---|
.github/workflows/deploy.yml |
Updates workflow triggers, job naming, dependencies, and deployment conditions. PR-triggered execution must use scoped, read-only permissions. |
Review details
Suppressed comments (1)
.github/workflows/deploy.yml:7
verifynow runs for pull requests, but the workflow-levelpagesconcurrency group is shared with deployments and hascancel-in-progress: false. A long-running PR can leave a main push pending, and a later PR run can replace that pending push, allowing a merge to complete without its deployment. Use separate concurrency groups for PR verification and main/manual deployment.
pull_request:
branches: [main]
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2c322244f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-authored-by: jasenc7 <274879716+jasenc7@users.noreply.github.com>
What
Fleet-wide convention: the one status check branch protection names is
verify. Thebuildjob is renamed, and the workflow now also runs on a pull request tomain, where it builds and stops.deploystays a push-to-main (or manual) step, gated onverifyand skipped on pull requests. Steps are untouched.Before this, nothing ran on a pull request here, so nothing gated one.
On merge
Require
verifyin branch protection if pull requests are used on this repo.🤖 Generated with Claude Code
https://claude.ai/code/session_01D6peoaf9UhhfLpnPbuiZbb
Generated by Claude Code