GitHub Actions workflows gate the build
CI that shows on every pull request keeps reviews honest. The workflow YAML in the repo is that contract, versioned with the code it checks. YAML is the contract The workflow YAML says both when something runs and with what rights, so it is the whole contract rather than just a recipe. A on: block names the triggers, a permissions: block pins what the workflow can touch, and a jobs: section declares the runners and steps. Because on is read before any job runs, a workflow is also where you decide that a pull_request must pass tests to be mergeable or a schedule can run it unsupervised. Version the file with the code it checks, so a branch’s CI always reflects the branch’s own contract. ...