From e3c9f5814f2b112b8d2d103e1f85cc23e2b5eae7 Mon Sep 17 00:00:00 2001
From: Viren Mohindra <VirenMohindra@users.noreply.github.com>
Date: Thu, 19 Mar 2026 02:39:09 -0400
Subject: [PATCH] ci: run full build and quality checks on push to main (#1091)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* ci: add full build and quality checks on push to main

Adds a new main-build.yml workflow that runs the full 7-platform build
matrix on every push to main, uploading artifacts for 30 days. Also
adds push-to-main triggers to code-quality, test, and nix-check
workflows. The nix full build now always runs on main pushes (not just
when nix packaging files change), catching the expensive breakage that
currently requires manual verification before each release.

* ci: fix permissions and clarify nix full-build intent

- narrow contents: write to contents: read in main-build.yml — no
  release assets are uploaded here so write access is unnecessary
- update nix-check comment to reflect that the full build always runs
  on push to main (not just when nix files change), matching intent
---
 .github/workflows/code-quality.yml | 12 +++++++
 .github/workflows/main-build.yml   | 52 ++++++++++++++++++++++++++++++
 .github/workflows/nix-check.yml    | 17 ++++++++--
 .github/workflows/test.yml         |  4 +++
 4 files changed, 82 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/main-build.yml

diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index bcc9a2d..ae8e864 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -1,6 +1,18 @@
 name: "code quality"
 on:
   workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "src/**"
+      - "package.json"
+      - "bun.lock"
+      - ".eslintrc*"
+      - "eslint.config.*"
+      - ".prettierrc*"
+      - "tsconfig*"
+      - "tailwind.config.*"
+      - ".github/workflows/**"
   pull_request:
     paths:
       - "src/**"
diff --git a/.github/workflows/main-build.yml b/.github/workflows/main-build.yml
new file mode 100644
index 0000000..2b2f87c
--- /dev/null
+++ b/.github/workflows/main-build.yml
@@ -0,0 +1,52 @@
+name: "Main Branch Build"
+
+# Runs the full cross-platform build on every push to main so breakage is
+# caught before a manual release is triggered. Artifacts are kept for 30 days
+# so any commit on main has a downloadable, testable build.
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: "macos-26"
+            args: "--target aarch64-apple-darwin"
+            target: "aarch64-apple-darwin"
+          - platform: "macos-latest"
+            args: "--target x86_64-apple-darwin"
+            target: "x86_64-apple-darwin"
+          - platform: "ubuntu-22.04"
+            args: "--bundles deb"
+            target: "x86_64-unknown-linux-gnu"
+          - platform: "ubuntu-24.04"
+            args: "--bundles appimage,rpm"
+            target: "x86_64-unknown-linux-gnu"
+          - platform: "ubuntu-24.04-arm"
+            args: "--bundles appimage,deb,rpm"
+            target: "aarch64-unknown-linux-gnu"
+          - platform: "windows-latest"
+            args: ""
+            target: "x86_64-pc-windows-msvc"
+          - platform: "windows-11-arm"
+            args: "--target aarch64-pc-windows-msvc"
+            target: "aarch64-pc-windows-msvc"
+
+    uses: ./.github/workflows/build.yml
+    with:
+      platform: ${{ matrix.platform }}
+      target: ${{ matrix.target }}
+      build-args: ${{ matrix.args }}
+      upload-artifacts: true
+      sign-binaries: false
+    secrets: inherit
diff --git a/.github/workflows/nix-check.yml b/.github/workflows/nix-check.yml
index 02739f0..b3261dc 100644
--- a/.github/workflows/nix-check.yml
+++ b/.github/workflows/nix-check.yml
@@ -9,6 +9,16 @@
 name: "nix build check"
 on:
   workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "flake.nix"
+      - "flake.lock"
+      - ".nix/**"
+      - "bun.lock"
+      - "src-tauri/**"
+      - "src/**"
+      - ".github/workflows/**"
   pull_request:
     paths:
       - "flake.nix"
@@ -106,8 +116,9 @@ jobs:
 
       # Full build — catches runtime build errors (broken dependencies,
       # sandbox issues, compilation failures) that flake eval alone misses.
-      # Only runs when nix packaging files change (~25 min with cold cache).
-      # Always runs on workflow_dispatch (manual trigger).
+      # On PRs: only runs when nix packaging files change (~25 min with cold cache).
+      # On push to main and workflow_dispatch: always runs so every commit on
+      # main has a verified nix build before release.
       - name: Build handy
-        if: steps.bun-check.outputs.outdated != 'true' && steps.eval.outputs.failed != 'true' && (steps.nix-files.outputs.changed == 'true' || github.event_name == 'workflow_dispatch')
+        if: steps.bun-check.outputs.outdated != 'true' && steps.eval.outputs.failed != 'true' && (steps.nix-files.outputs.changed == 'true' || github.event_name == 'workflow_dispatch' || github.event_name == 'push')
         run: nix build .#handy -L --show-trace
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cff3b82..4598eba 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,6 +1,10 @@
 name: "test"
 on:
   workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "src-tauri/**"
   pull_request:
     paths:
       - "src-tauri/**"