ci: run full build and quality checks on push to main (#1091)

* ci: add full build and quality checks on push to main

Adds a new main-build.yml workflow that runs the full 7-platform build
matrix on every push to main, uploading artifacts for 30 days. Also
adds push-to-main triggers to code-quality, test, and nix-check
workflows. The nix full build now always runs on main pushes (not just
when nix packaging files change), catching the expensive breakage that
currently requires manual verification before each release.

* ci: fix permissions and clarify nix full-build intent

- narrow contents: write to contents: read in main-build.yml — no
  release assets are uploaded here so write access is unnecessary
- update nix-check comment to reflect that the full build always runs
  on push to main (not just when nix files change), matching intent

.github/workflows/code-quality.yml

@@ -1,6 +1,18 @@
 name: "code quality"
 on:
   workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "src/**"
+      - "package.json"
+      - "bun.lock"
+      - ".eslintrc*"
+      - "eslint.config.*"
+      - ".prettierrc*"
+      - "tsconfig*"
+      - "tailwind.config.*"
+      - ".github/workflows/**"
   pull_request:
     paths:
       - "src/**"

.github/workflows/main-build.yml

@@ -0,0 +1,52 @@
+name: "Main Branch Build"
+
+# Runs the full cross-platform build on every push to main so breakage is
+# caught before a manual release is triggered. Artifacts are kept for 30 days
+# so any commit on main has a downloadable, testable build.
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: "macos-26"
+            args: "--target aarch64-apple-darwin"
+            target: "aarch64-apple-darwin"
+          - platform: "macos-latest"
+            args: "--target x86_64-apple-darwin"
+            target: "x86_64-apple-darwin"
+          - platform: "ubuntu-22.04"
+            args: "--bundles deb"
+            target: "x86_64-unknown-linux-gnu"
+          - platform: "ubuntu-24.04"
+            args: "--bundles appimage,rpm"
+            target: "x86_64-unknown-linux-gnu"
+          - platform: "ubuntu-24.04-arm"
+            args: "--bundles appimage,deb,rpm"
+            target: "aarch64-unknown-linux-gnu"
+          - platform: "windows-latest"
+            args: ""
+            target: "x86_64-pc-windows-msvc"
+          - platform: "windows-11-arm"
+            args: "--target aarch64-pc-windows-msvc"
+            target: "aarch64-pc-windows-msvc"
+
+    uses: ./.github/workflows/build.yml
+    with:
+      platform: ${{ matrix.platform }}
+      target: ${{ matrix.target }}
+      build-args: ${{ matrix.args }}
+      upload-artifacts: true
+      sign-binaries: false
+    secrets: inherit

.github/workflows/nix-check.yml

@@ -9,6 +9,16 @@
 name: "nix build check"
 on:
   workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "flake.nix"
+      - "flake.lock"
+      - ".nix/**"
+      - "bun.lock"
+      - "src-tauri/**"
+      - "src/**"
+      - ".github/workflows/**"
   pull_request:
     paths:
       - "flake.nix"
@@ -106,8 +116,9 @@ jobs:
 
       # Full build — catches runtime build errors (broken dependencies,
       # sandbox issues, compilation failures) that flake eval alone misses.
-      # Only runs when nix packaging files change (~25 min with cold cache).
-      # Always runs on workflow_dispatch (manual trigger).
+      # On PRs: only runs when nix packaging files change (~25 min with cold cache).
+      # On push to main and workflow_dispatch: always runs so every commit on
+      # main has a verified nix build before release.
       - name: Build handy
-        if: steps.bun-check.outputs.outdated != 'true' && steps.eval.outputs.failed != 'true' && (steps.nix-files.outputs.changed == 'true' || github.event_name == 'workflow_dispatch')
+        if: steps.bun-check.outputs.outdated != 'true' && steps.eval.outputs.failed != 'true' && (steps.nix-files.outputs.changed == 'true' || github.event_name == 'workflow_dispatch' || github.event_name == 'push')
         run: nix build .#handy -L --show-trace

.github/workflows/test.yml

@@ -1,6 +1,10 @@
 name: "test"
 on:
   workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "src-tauri/**"
   pull_request:
     paths:
       - "src-tauri/**"