From ad473820e103f24c803f69660f236b619dfffc27 Mon Sep 17 00:00:00 2001
From: SyniRon <66834451+SyniRon@users.noreply.github.com>
Date: Mon, 27 Jul 2026 17:15:22 -0400
Subject: [PATCH] fix(ci): run the Go workflow on pull_request (#245)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The workflow triggered on `push` only. A contributor without push access
forks, pushes to their fork, and opens a PR — the push event fires in
their repo, so the Build/Lint/Test runs attach there and never reach the
PR here. With those contexts required and no bypass actors since #243,
such a PR is permanently unmergeable. No fork PR has ever been opened
against this repo, so this has not fired; it is now a hard block rather
than a soft one, which is what makes it worth closing.

`push` is narrowed to develop rather than left bare alongside the new
trigger. A same-repo PR matches both events, so an unscoped `push` would
run the whole suite twice per PR and surface each required context twice
— the ambiguity that makes required checks unreliable. One run per event
now: PRs via `pull_request`, develop keeps its post-merge run.

Trade-off: pushing a feature branch no longer runs CI until a PR exists.
The ruleset requires a PR for every change, so nothing reaches develop
unchecked.

The workflow references no secrets, so it runs correctly under the
read-only token a fork PR receives.

> *This was generated by AI*
---
 .github/workflows/go.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index afe186a..9c8ed78 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -1,5 +1,17 @@
 name: Go
-on: [push]
+# `pull_request` is what lets a fork PR be merged at all: a contributor without
+# push access pushes to their own fork, so the push event fires there and the
+# Build/Lint/Test runs never attach to the PR here — leaving the required
+# contexts permanently unsatisfiable.
+#
+# `push` is narrowed to develop rather than left bare. A same-repo PR matches
+# both events, so an unscoped `push` would run the whole suite twice per PR and
+# surface each required context twice. This way it is one run per event: PRs are
+# covered by `pull_request`, develop keeps its post-merge run.
+on:
+  push:
+    branches: [develop]
+  pull_request:
 jobs:
   build:
     name: Build