From 6a3e425edf1cd9ff779dbf63e9f2cc12d267dd43 Mon Sep 17 00:00:00 2001
From: KJGBot <khaliqgant+kjgbot@gmail.com>
Date: Thu, 8 Oct 2026 15:08:31 -0700
Subject: [PATCH] ci: run CI only for trunk PRs and main pushes

Feature branches no longer run CI. Jobs triggered by pull_request(_target)
run only when the head branch is `trunk`; push triggers are limited to main
(release/env/tag pushes unchanged). trunk-guard.yml flags any PR into main
that does not come from `trunk`.
---
 .github/workflows/ci.yml               |  8 +++++++-
 .github/workflows/compact-on-merge.yml |  4 +++-
 .github/workflows/trunk-guard.yml      | 17 +++++++++++++++++
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/trunk-guard.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc37c38..c67d461 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,7 @@ on:
 
 jobs:
   lint:
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
     name: Lint
     runs-on: ubuntu-latest
     steps:
@@ -27,6 +28,7 @@ jobs:
         run: npm run lint
 
   typecheck:
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
     name: Type Check
     runs-on: ubuntu-latest
     steps:
@@ -46,6 +48,7 @@ jobs:
         run: npm run typecheck
 
   test:
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
     name: Test (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest
     strategy:
@@ -75,6 +78,7 @@ jobs:
         run: npm run test:run
 
   build:
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
     name: Build
     runs-on: ubuntu-latest
     steps:
@@ -103,7 +107,9 @@ jobs:
     name: CI Success
     needs: [lint, typecheck, test, build]
     runs-on: ubuntu-latest
-    if: always()
+    if: >-
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') &&
+      (always())
     steps:
       - name: Check all jobs passed
         run: |
diff --git a/.github/workflows/compact-on-merge.yml b/.github/workflows/compact-on-merge.yml
index baa6548..fbf5b31 100644
--- a/.github/workflows/compact-on-merge.yml
+++ b/.github/workflows/compact-on-merge.yml
@@ -9,7 +9,9 @@ on:
 jobs:
   compact:
     # Only run when PR is actually merged, not just closed
-    if: github.event.pull_request.merged == true
+    if: >-
+      ((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') &&
+      (github.event.pull_request.merged == true)
     runs-on: ubuntu-latest
 
     permissions:
diff --git a/.github/workflows/trunk-guard.yml b/.github/workflows/trunk-guard.yml
new file mode 100644
index 0000000..2ddb497
--- /dev/null
+++ b/.github/workflows/trunk-guard.yml
@@ -0,0 +1,17 @@
+name: Trunk guard
+
+# Only the `trunk` branch may merge into main. Feature branches merge into
+# `trunk` (via the merge train); CI runs only on the trunk -> main PR.
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  only-trunk-merges-to-main:
+    if: github.head_ref != 'trunk'
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - run: |
+          echo "::error::Only the 'trunk' branch may merge into main. Retarget this PR to 'trunk'."
+          exit 1