From ff176af776847277c911d11539b8929c2392ac58 Mon Sep 17 00:00:00 2001 From: bgard68 <30295154+bgard68@users.noreply.github.com> Date: Fri, 11 Sep 2026 07:23:28 -0500 Subject: [PATCH] ci: let CI, web CI and the secret scan be triggered on demand MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follows the same change made to CodeQL in #116, for the same reason: every trigger on these waits on an event, so none of them can be asked a question. web-ci needed it most. Its paths filter is ['web/**', its own file], which is correct — a backend-only change has no reason to rebuild the SPA — but it also means the workflow can go unexercised for long stretches, and it was the one workflow still absent from the Actions registry because nothing had triggered it. The other two recovered on their own once a pull request ran them. The secret scan gains the ability to rescan history after a rule change in .gitleaks.toml without waiting for the next push to main. Deliberately unchanged: dependency-review stays pull_request-only. The action diffs a base against a head, so a manual run would have nothing to compare — its own header says so. keep-warm stays disabled_manually. That is a deployment decision about a free tier, not a registration problem, and is not mine to reverse. No paths filters on any of the manual triggers: pressing the button is an explicit request to run the whole thing. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 4 ++++ .github/workflows/secret-scan.yml | 4 ++++ .github/workflows/web-ci.yml | 5 +++++ 3 files changed, 13 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dc96219..d49976a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,10 @@ on: - 'LICENSE' - '.gitignore' + # On demand. The triggers above both wait on an event, so a green build can only be confirmed + # by producing one. No paths-ignore here: asking by hand means asking for the whole thing. + workflow_dispatch: + permissions: contents: read diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index d528ac0..3f02946 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -7,6 +7,10 @@ on: pull_request: branches: [main] + # On demand, so history can be rescanned after a rule change in .gitleaks.toml without + # waiting for the next push to main. + workflow_dispatch: + permissions: contents: read diff --git a/.github/workflows/web-ci.yml b/.github/workflows/web-ci.yml index 236d8dc..f6570e1 100644 --- a/.github/workflows/web-ci.yml +++ b/.github/workflows/web-ci.yml @@ -8,6 +8,11 @@ on: branches: [main] paths: ['web/**', '.github/workflows/web-ci.yml'] + # On demand, and this one needs it most: the paths filter means a change outside web/ never + # runs it, so it can sit unexercised for long stretches with nothing reporting that. No paths + # filter on the manual trigger — the point of pressing it is to run regardless. + workflow_dispatch: + permissions: contents: read