name: CI
on:
push:
branches:
pull_request:
# All actual checks live in ci-checks.yml as a reusable workflow so PR-time
# CI and release.yml's publish-gate run the exact same suite — single source
# of truth, no copy-paste drift.
jobs:
checks:
uses: ./.github/workflows/ci-checks.yml
permissions:
contents: read
security-events: write
secrets: inherit