name: ci

# Repo-specific checks run through checks.yml. Generic vet, staticcheck,
# govulncheck, gosec and tests run in pr.yaml (shared go-pr). Releases run in
# release.yml (shared go-release), gated by the same checks.yml.
on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

# Cancel any in-flight CI runs for the same branch when a new push lands.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  checks:
    uses: ./.github/workflows/checks.yml

  # Aggregate gate for the repo-local checks. Keeps the `ci-success` name
  # so an existing branch-protection rule keeps resolving.
  ci-success:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: [checks]
    if: always()
    steps:
      - name: All checks passed
        if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
        run: echo "ci-success"
      - name: At least one check failed
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        run: |
          echo "Failed/cancelled jobs:"
          echo '${{ toJSON(needs) }}'
          exit 1