ci.yml

name: CI

# Lint + test + audit on every branch push and pull request, except pushes to the
# `release` branch: release.yml runs the same checks there as a gate before publishing,
# so a candidate does not double-run them here. Tag pushes never match (branches: '**'
# matches branches, not tags), and release.yml's own pushes of `main` and the tag
# are made with the workflow token, which triggers no workflow at all.
#
# A build job runs after quality — deliberately gated on lint, test and audit, so a
# push that cannot pass them never spends a build — and uploads the binaries as a
# GitHub Actions artifact (retention: 1 day). This lets you grab a build from any
# commit without waiting for a release. The guest kernel is excluded — it compiles
# a full Linux kernel (tens of minutes) and changes infrequently; use release.yml
# or build-kernel.sh locally when you need a new vmlinux.
#
# The kernel is built (and embedded into vk) when the workflow is triggered
# manually (workflow_dispatch), for testing kernel config changes without cutting
# a release.

on:
  push:
    branches:
      - '**'
      - '!release'
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  quality:
    uses: ./.github/workflows/quality.yml

  build:
    needs: [quality]
    uses: ./.github/workflows/build.yml
    with:
      artifact-prefix: ci
      build-kernel: ${{ github.event_name == 'workflow_dispatch' }}
      retention-days: 1