From 315f2407394c658a9bc3d7722e01b5c65a4ba0b6 Mon Sep 17 00:00:00 2001 From: Sal Date: Sat, 12 Sep 2026 09:51:18 +0100 Subject: [PATCH] ci(zunit): test the pull request instead of the base branch The workflow triggered on `pull_request_target' with a bare actions/checkout, which resolves to the base branch. Every pull request run therefore tested `main': on z-shell/zsh-string-lib#11 it reported "6 tests run" while that branch has 9, and reported success without executing a single changed line. The job installs zunit from public sources and reads no secrets, so the plain `pull_request' trigger is both correct and the safer default. --- .github/workflows/zunit.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/zunit.yml b/.github/workflows/zunit.yml index 3d6a158..db5c7cb 100644 --- a/.github/workflows/zunit.yml +++ b/.github/workflows/zunit.yml @@ -1,10 +1,15 @@ name: 🛡️ ZUnit +# `pull_request', not `pull_request_target'. Under pull_request_target a bare +# actions/checkout resolves to the base branch, so every run tested `main' and +# reported its test count no matter what the pull request changed. This job needs +# no secrets and no write token, so the plain trigger is both correct and safer. + on: workflow_dispatch: push: branches: [main] - pull_request_target: + pull_request: branches: [main] jobs: