From 9a3a9053d729986262653dad9a5cbffa532d400b Mon Sep 17 00:00:00 2001
From: Ben Cox <bcox@mpp.mpg.de>
Date: Tue, 28 Jul 2026 12:27:57 +0200
Subject: [PATCH] Run the test suite in CI, on every branch push
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only workflow ran on pushes to main and only ever invoked
`npm run build` — the 180 tests had never run anywhere but a
contributor's machine, and pull requests reported no checks at all.

Adds ci.yml: npm test plus npm run build (which is `tsc --noEmit &&
vite build`, so it type-checks too) on every branch push, and on pull
requests from forks. A pull request from a branch in this repo is skipped,
since the push event already covered that commit; without the guard every
such commit would be checked twice.

deploy.yml now runs the suite before building, so main cannot publish a
build whose tests fail. Deployment stays confined to deploy.yml and to
main — nothing in ci.yml publishes, and no branch push can reach Pages.
---
 .github/workflows/ci.yml     | 36 ++++++++++++++++++++++++++++++++++++
 .github/workflows/deploy.yml |  4 ++++
 2 files changed, 40 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..f457319
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,36 @@
+name: CI
+
+# Every branch push, so a branch is checked before it ever reaches a pull
+# request. Deployment lives in deploy.yml and stays restricted to main — nothing
+# here publishes anything.
+on:
+  push:
+    branches: ['**']
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# One run per ref: pushing again supersedes an in-flight check of the same branch.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    # For a branch in this repo the push event already covers it, so skip the
+    # duplicate pull_request run. Fork PRs raise no push event here, and are the
+    # reason the pull_request trigger is kept at all.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm test
+      # `npm run build` is `tsc --noEmit && vite build`, so this type-checks too.
+      - run: npm run build
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b7b52c7..b9cec23 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -24,6 +24,10 @@ jobs:
           node-version: 22
           cache: npm
       - run: npm ci
+      # Gate the deploy on the suite: main should not publish a build whose tests
+      # fail. CI (ci.yml) runs the same command on every branch push; this is the
+      # last check before the site is actually replaced.
+      - run: npm test
       - run: npm run build
         env:
           NODE_ENV: production