Two gaps, one of them wide.
The contract tests added in c349e15c already ran inside `pytest -nauto`, but
fixture drift is silent by nature -- the frontend suite passes against a body the
API stopped sending -- so it deserves a check whose name says what broke.
`api-contract-tests` restores the same dependency cache as the other Python jobs,
skips the ffmpeg/catdoc install it does not need (verified), and runs the one
file, so it answers in under a minute instead of somewhere inside seventeen
hundred results.
The wide one: jest-tests.yml triggered on `pull_request: branches: [master]`, so
a pull request into anything else ran neither jest nor the webpack build. The
entire Semantic UI to Mantine migration went in that way -- seventy-five files
across nine pull requests into feature/custom-theme, not one of which ran either.
The build step is the one that matters most: jest and tsc both pass on a named
import that does not exist and only webpack rejects it, which is exactly how a
broken Archive.js survived a "clean" run earlier in this migration. The suite
did run on the branch after each merge, which is the wrong side of the merge to
learn about it.
`pull_request` is now unfiltered rather than listing branches, so the next
long-lived branch does not have to remember to add itself. It stays
`pull_request`, not `pull_request_target`: a fork's run gets a read-only token
and no secrets, and this workflow interpolates no event data, so widening the
trigger adds no injection or exfiltration path.
Worth knowing separately: none of this gates anything. master has no branch
protection and the only ruleset covers `release` (deletion, non-fast-forward), so
every check here is advisory. That is a repository setting, and Roland's to make.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fb4677bcd6