From 9cdf1ad56b8a1910c382ef72c7b15d9f96d86692 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Mon, 2 Nov 2026 15:42:57 -0500
Subject: [PATCH 1/2] ci: Run build and test on every pull request

Tests ran only on push, behind a paths filter in some repos, so a fork's pull
request got no check and a change outside the filter was never tested. Call
the shared ci-basic workflow on pull_request so every PR reports
"ci / Build and test", ready to be a required check.

The old push-only test workflow is removed; ci-basic runs the same go test
plus a build, so keeping both would test every push twice.
---
 .github/workflows/ci.yaml      | 13 +++++++++++++
 .github/workflows/testing.yaml | 20 --------------------
 2 files changed, 13 insertions(+), 20 deletions(-)
 create mode 100644 .github/workflows/ci.yaml
 delete mode 100644 .github/workflows/testing.yaml

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..f8430e5
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,13 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    uses: datum-cloud/actions/.github/workflows/ci-basic.yaml@v1.26.0
diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml
deleted file mode 100644
index c3ef2c1..0000000
--- a/.github/workflows/testing.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: "ctl testing"
-on:
-  push:
-    paths:
-      - '**/*.go'
-      - 'go.mod'
-      - 'go.sum'
-
-jobs:
-  testing:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-      - name: Install dependencies
-        run: go mod download
-      - name: Verify dependencies
-        run: go mod verify
-      - name: Test
-        run: go test -timeout 5m ./...

From 59d5ba192a1033ec67e26f266013fa794594c3f6 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Mon, 2 Nov 2026 15:55:20 -0500
Subject: [PATCH 2/2] ci: Keep verifying module checksums

The removed push-only test workflow ran go mod verify, which ci-basic
doesn't. Run it in the CI check so a tampered or mismatched module still
fails the build.
---
 .github/workflows/ci.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index f8430e5..2bc6fd7 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -11,3 +11,5 @@ permissions:
 jobs:
   ci:
     uses: datum-cloud/actions/.github/workflows/ci-basic.yaml@v1.26.0
+    with:
+      run: go mod verify