name: ship-ci

# PRs into both main and release/** run CI through this wrapper so the check
# runs are named "ci / <job>" (reusable-workflow caller prefix), matching the
# org rulesets' required contexts. ci.yml itself only triggers via
# workflow_call — it never runs standalone, which would emit unprefixed
# "<job>" checks that the rulesets can't match.
on:
  pull_request:
    branches: [main, 'release/**']

permissions:
  contents: read
  pull-requests: read
  checks: read

jobs:
  ci:
    uses: ./.github/workflows/ci.yml