From 1a0c6a1c4f1f921a81504480cbd7309b6f78bb32 Mon Sep 17 00:00:00 2001
From: Jacob Clayden <me@jacobcx.dev>
Date: Thu, 17 Sep 2026 22:11:29 +0100
Subject: [PATCH] ci: restored required pull request checks

- Added automatic build, vet and race checks on pull requests.
- Cancelled superseded runs and used the declared toolchain.
- Kept packaging and native validation manually dispatched.
- Documented required checks and branch freshness.
---
 .github/workflows/pr.yml          | 30 ++++++++++++++++++++++++++++++
 CONTRIBUTING.md                   |  4 ++++
 cmd/cq/release_provenance_test.go |  2 +-
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/pr.yml

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
new file mode 100644
index 0000000..3f32a6b
--- /dev/null
+++ b/.github/workflows/pr.yml
@@ -0,0 +1,30 @@
+name: PR checks
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  build-vet-test:
+    name: Build, vet and race tests
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - run: go build ./...
+      - run: go vet ./...
+      - run: go test -race -count=1 ./...
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d5ef9f6..042e777 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -43,6 +43,10 @@ Types: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `perf`, `ci`
 
 ## CI Gates
 
+Every pull request into `main` runs the required **Build, vet and race tests** check on Linux ARM64, using the Go version declared in `go.mod`. Superseded runs are cancelled. The branch must be up to date with `main` before merging.
+
+Packaging, installed-client and native platform validation remain available through the manual **CI** workflow. Release publication remains manual through **Release**.
+
 All checks must pass before merge:
 
 ```bash
diff --git a/cmd/cq/release_provenance_test.go b/cmd/cq/release_provenance_test.go
index 8656073..3c16a5d 100644
--- a/cmd/cq/release_provenance_test.go
+++ b/cmd/cq/release_provenance_test.go
@@ -442,7 +442,7 @@ func TestCICoversSupportedNativePlatforms(t *testing.T) {
 	}
 }
 
-func TestGitHubWorkflowsRunOnlyWhenDispatched(t *testing.T) {
+func TestNativeValidationAndReleaseRequireDispatch(t *testing.T) {
 	for _, path := range []string{
 		"../../.github/workflows/ci.yml",
 		"../../.github/workflows/release.yml",