ci: run every workflow on merge to main, except the release

[eaitbrahim]

The repository became public on 2026-08-15. GitHub bills no Actions minutes for standard runners on public repositories, so the cost argument that kept code-quality and migrate off push no longer applies.

Final trigger set

workflow	triggers	on merge to main?
ci.yml	pull_request, push [main], workflow_dispatch	yes (unchanged)
code-quality.yml	push [main], schedule, workflow_dispatch	new
migrate.yml	push [main], workflow_dispatch	new
release.yml	workflow_dispatch	no — deliberately

release.yml stays manual

By explicit instruction, and it could not work otherwise: its version input is required, a push event supplies no inputs, so the job would fail at its first validation step. Its own header already states the rule — "Nothing about a money-moving tool should ship on a merge."

The safety property that makes migrate on push sound

This is a property of the event, not of anyone's care. db_path is a workflow_dispatch input; a push carries no inputs, so on a merge ${{ inputs.db_path }} renders empty and the job always takes its migration_smoke.py branch. No merge can supply a value that makes it write to a real database. The comment says so, and says not to add a default target or read one from a repo variable — either would remove the property.

code-quality keeps its schedule, and still has no pull_request

The weekly run is kept rather than replaced: a CVE published against an unchanged pin is invisible to a per-merge trigger and obvious to a scheduled one.

pull_request remains absent, and on a public repo that is now a security choice rather than a cost one — fork PRs receive no repository secrets, so every one would fail at the preflight for a reason the contributor cannot fix.

⚠️ Known consequence

SONAR_TOKEN and SNYK_TOKEN do not exist at repo or org level, so code-quality will fail its preflight on every merge until they are added. That job exists to say why in one line rather than let the scanners fail obscurely — but it will now say it on every merge rather than once a week. Add the two secrets, or say the word and I will make the preflight skip cleanly instead of failing red.

🤖 Generated with Claude Code