name: Ship CI

# PRs into both main and release/** run CI through this wrapper so the check
# run is named "CI / check" (reusable-workflow caller prefix from the `CI`
# job), matching the org rulesets' required context. ci.yml itself only
# triggers via workflow_call — it never runs standalone, which would emit an
# unprefixed "check" the rulesets can't match.
on:
  pull_request:
    branches: [main, 'release/**']
  # Trunk-based: post-merge CI on main catches semantic conflicts between
  # independently-green PRs; push on release/** covers stabilization
  # cherry-picks that land without a PR.
  push:
    branches: [main, 'release/**']
  workflow_dispatch:

concurrency:
  group: ship-ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  CI:
    uses: ./.github/workflows/ci.yml