From f6f19fce2c76947c51495f1dbd4d12a02fc5ed3b Mon Sep 17 00:00:00 2001
From: CJ Rivas <cj.rivas.dev@gmail.com>
Date: Sat, 5 Sep 2026 16:00:18 -0400
Subject: [PATCH 1/5] PMX: Rename `ci.yml` to `pull-request-checks.yml`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- `🔁 CI` becomes `🧪 Pull Request Checks` — the file only ever runs
  pull-request checks, so the name should say so
- drop the `push: branches: [main]` trigger — the existing comment
  already notes `pull_request` covers branch pushes, so it was dead
  scope
- job id/name `checks`/`🔍 Checks` becomes `pull-request-checks`/
  `🚦 Pull request checks` to match the file rename
---
 .github/workflows/{ci.yml => pull-request-checks.yml} | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
 rename .github/workflows/{ci.yml => pull-request-checks.yml} (92%)

diff --git a/.github/workflows/ci.yml b/.github/workflows/pull-request-checks.yml
similarity index 92%
rename from .github/workflows/ci.yml
rename to .github/workflows/pull-request-checks.yml
index e2e90f7..82e6c1d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/pull-request-checks.yml
@@ -1,9 +1,8 @@
-name: 🔁 CI
+name: 🧪 Pull Request Checks
 
 on:
   pull_request:
   push:
-    branches: [main]
   workflow_dispatch:
 
 # `pull_request` already covers branch pushes; `branches: ['**']` ran every
@@ -19,8 +18,8 @@ env:
   BUN_VERSION: 1.4.0
 
 jobs:
-  checks:
-    name: 🔍 Checks
+  pull-request-checks:
+    name: 🚦 Pull request checks
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:

From 124cd64f57a9bdc9feb7c81db5b1c5c8ce5277c1 Mon Sep 17 00:00:00 2001
From: CJ Rivas <cj.rivas.dev@gmail.com>
Date: Sat, 5 Sep 2026 16:00:26 -0400
Subject: [PATCH 2/5] PMX: Add `sanity-check.yml` for an independent `main`
 health signal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- `pull-request-checks.yml` sets `concurrency: cancel-in-progress: true`
  unconditionally — a rapid second push to `main` can cancel the first
  push's check run with no completed record left behind
- new `✅ Sanity check` workflow runs on `push: branches: [main]` only,
  with `cancel-in-progress: false`, so every push to `main` gets a
  completed run
- runs `bun run system-check` — `format:check`, `build:types`, `lint`,
  `test`, `build:vite` — the same full gate as pull requests
- `deploy.yml` already builds, tests, and deploys on push to `main`,
  but gives no standalone "is `main` healthy" signal independent of
  the deploy pipeline
---
 .github/workflows/sanity-check.yml | 49 ++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/sanity-check.yml

diff --git a/.github/workflows/sanity-check.yml b/.github/workflows/sanity-check.yml
new file mode 100644
index 0000000..4e8e6ac
--- /dev/null
+++ b/.github/workflows/sanity-check.yml
@@ -0,0 +1,49 @@
+name: ✅ Sanity check
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  BUN_VERSION: 1.4.0
+
+jobs:
+  sanity-check:
+    name: 🩺 Sanity check
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: 📥 Checkout
+        uses: actions/checkout@v4
+
+      - name: 🥟 Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: ♻️ Restore dependency cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: ${{ runner.os }}-bun-
+
+      - name: 📦 Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: 🚦 Full check
+        run: bun run system-check
+
+      - name: 🎉 All clear
+        run: echo "✅ ${GITHUB_SHA:0:7} landed on \`main\` clean — format, types, lint, tests, and build all green." >> "$GITHUB_STEP_SUMMARY"
+
+      - name: 🚨 Something broke
+        if: failure()
+        run: echo "💥 ${GITHUB_SHA:0:7} broke \`main\` — check the failed step above." >> "$GITHUB_STEP_SUMMARY"

From 3660d0113ad84dd505996e5738058e25bade635d Mon Sep 17 00:00:00 2001
From: CJ Rivas <cj.rivas.dev@gmail.com>
Date: Sat, 5 Sep 2026 16:04:31 -0400
Subject: [PATCH 3/5] PMX: Sentence-case the `pull-request-checks.yml` workflow
 name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- `🧪 Pull Request Checks` becomes `🧪 Pull request checks` to match
  the sentence-case convention used across workflow `name:` fields
---
 .github/workflows/pull-request-checks.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pull-request-checks.yml b/.github/workflows/pull-request-checks.yml
index 82e6c1d..50d363d 100644
--- a/.github/workflows/pull-request-checks.yml
+++ b/.github/workflows/pull-request-checks.yml
@@ -1,4 +1,4 @@
-name: 🧪 Pull Request Checks
+name: 🧪 Pull request checks
 
 on:
   pull_request:

From d56814b9a31a1dab76eecec4d39c22f81af203a5 Mon Sep 17 00:00:00 2001
From: CJ Rivas <cj.rivas.dev@gmail.com>
Date: Sat, 5 Sep 2026 16:19:49 -0400
Subject: [PATCH 4/5] PMX: Restore the `checks` job id and name in
 `pull-request-checks.yml`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- the file rename should not have touched the job — `pull-request-checks`/
  `🚦 Pull request checks` reverts to `checks`/`🔍 Checks`, verbatim from
  `main`
- only the top-level workflow `name:` was meant to change, and it stays
  `🧪 Pull request checks`
- `on:` trigger changes are unaffected — the dropped `push: branches:
  [main]` scope stays dropped
---
 .github/workflows/pull-request-checks.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pull-request-checks.yml b/.github/workflows/pull-request-checks.yml
index 50d363d..27bc1ae 100644
--- a/.github/workflows/pull-request-checks.yml
+++ b/.github/workflows/pull-request-checks.yml
@@ -18,8 +18,8 @@ env:
   BUN_VERSION: 1.4.0
 
 jobs:
-  pull-request-checks:
-    name: 🚦 Pull request checks
+  checks:
+    name: 🔍 Checks
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:

From 0cb777064f5d40520f1ee34dc0c6fdde2efbe992 Mon Sep 17 00:00:00 2001
From: CJ Rivas <cj.rivas.dev@gmail.com>
Date: Sat, 5 Sep 2026 16:50:02 -0400
Subject: [PATCH 5/5] PMX: Trigger `pull-request-checks.yml` on `pull_request`
 only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- bare `push:` was unscoped, which is the `branches: ['**']` case the
  file's own comment warned about — every commit on this branch ran the
  workflow twice, once per event (runs `33989796613` and `33989799860`
  on `d56814b`)
- `on:` is now `pull_request:` alone, so pull request checks never run
  on `main` — `sanity-check.yml` owns that signal
- `workflow_dispatch:` dropped: a manual run of PR checks outside a pull
  request has no branch to check against
- the comment above `concurrency` is deleted rather than reworded — the
  double-run condition it described no longer exists
---
 .github/workflows/pull-request-checks.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/pull-request-checks.yml b/.github/workflows/pull-request-checks.yml
index 27bc1ae..14cacb3 100644
--- a/.github/workflows/pull-request-checks.yml
+++ b/.github/workflows/pull-request-checks.yml
@@ -2,11 +2,7 @@ name: 🧪 Pull request checks
 
 on:
   pull_request:
-  push:
-  workflow_dispatch:
 
-# `pull_request` already covers branch pushes; `branches: ['**']` ran every
-# PR commit twice.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true