From 9b14a046354121299aa1dd4ee0eba4b8bd7d90c1 Mon Sep 17 00:00:00 2001
From: jamiecobbett <jcobbett@gocardless.com>
Date: Wed, 5 Aug 2026 17:46:33 +0100
Subject: [PATCH 1/2] Add pull_request trigger to CI workflow

Required to support requiring the build check in branch protection - a
push-only trigger never runs against a fork PR's head commit, which
would block external contributions once the check is required. The
existing build job already needs the full test matrix, so it can serve
as the single required check without a separate aggregator job.
---
 .github/workflows/build.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4aabd0cf..f1c66459 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,5 +1,9 @@
 name: build & publish
-on: push
+on:
+  push:
+    branches: [master]
+  pull_request:
+    types: [opened, reopened, synchronize]
 
 permissions:
   contents: write  # Required for creating releases and tags

From aef1acbcb766383903fd417676dc41a1ef2472d2 Mon Sep 17 00:00:00 2001
From: jamiecobbett <jcobbett@gocardless.com>
Date: Wed, 5 Aug 2026 17:54:59 +0100
Subject: [PATCH 2/2] Add all-tests-passed aggregator job

Gives branch protection a single, stable check name to require,
independent of what jobs the workflow happens to run - so adding a
matrix build or a lint job later only means updating this job's
needs list, not the required checks in Terraform.
---
 .github/workflows/build.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f1c66459..fa31ecbe 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,6 +44,19 @@ jobs:
           name: dist
           path: dist/
 
+  all-tests-passed:
+    name: All tests passed
+    runs-on: ubuntu-latest
+    needs: [test, build]
+    if: always()
+    steps:
+      - name: Check test/build job status
+        run: |
+          if [ "${{ needs.test.result }}" != "success" ] || [ "${{ needs.build.result }}" != "success" ]; then
+            echo "test or build job did not succeed"
+            exit 1
+          fi
+
   check_version:
     if: github.ref == 'refs/heads/master'
     runs-on: ubuntu-latest