[NSchatz]

CI on main now also runs every night, and can be started by hand.

What changes

.github/workflows/ci.yml gets two more triggers. push and pull_request stay as they are:

  schedule:
    # The nightly run on main, 05:35 UTC. An odd minute: GitHub delays scheduled runs at the start of every hour.
    - cron: "35 5 * * *"
  workflow_dispatch:

A scheduled run tests the latest commit on the default branch. So if main goes red with no push behind it (a dependency, a runner image, an expired date, the shared workflow), we find out the next morning.

Why no job needed a guard

We read every job and step in this workflow (ci, examples) and in the reusable cosyte/.github/.github/workflows/ci.yml@main that ci calls (verify, prepublish, actionlint). None of them reads github.event.pull_request.*, github.head_ref, github.base_ref, github.event.before or github.event_name, and none diffs against a PR base. No other workflow in this repo is triggered by CI completing, so a nightly run starts nothing else.

The shared actionlint job runs reviewdog/action-actionlint (image v1.72.0: reviewdog v0.21.0, actionlint 1.7.12) with its default github-pr-check reporter. In reviewdog v0.21.0 (cmd/reviewdog/main.go), inside GitHub Actions with no REVIEWDOG_TOKEN, that reporter skips the doghouse server and, when the build is not a pull request, switches to nofilter. So on a nightly run it still lints every workflow file and still fails on a finding, rather than skipping. Pushes to main already take this path and have been green.

No job was renamed or dropped, so the required checks (ci / actionlint, ci / verify (22, ubuntu-latest), ci / verify (24, ubuntu-latest)) are unchanged. A pull-request run checks exactly what it did before.

Proof of the non-PR path

gh workflow run ci.yml -R cosyte/transform --ref harness/44-nightly-run-of-ci was accepted and ran as a workflow_dispatch event on the head commit 4daf098: https://github.com/cosyte/transform/actions/runs/39355629604

It concluded success on the first attempt, with all five jobs green: ci / verify (22, ubuntu-latest), ci / verify (24, ubuntu-latest), ci / actionlint, ci / prepublish and examples. The ci / actionlint log has no "this is not PullRequest build" line, so reviewdog took the linting path rather than skipping.

Gate run locally

All passed: typecheck, lint, format:check, phi-scan, check:no-emdash, ci:no-internal-refs, test (952 tests), test:coverage, build, attw, the dual ESM/CJS smoke, the examples job's four steps (typecheck:examples, lint:examples, examples, phi-scan:examples), and actionlint 1.7.12 over .github/workflows/*.yml.

test:coverage at the default worker count (56 here) timed out in the test/conformance/ suites twice, at the 10 s test timeout, while the host's load average was about 45 from other work. Those suites passed alone, the full pnpm test passed, and test:coverage --maxWorkers=8 passed with every coverage threshold met. This change touches no test or source file, and CI runs with its own runner.

Notes

• The workflow's concurrency group is ${{ github.workflow }}-${{ github.ref }} with cancel-in-progress: true. A scheduled run and a push run on main therefore share one group, and whichever starts second cancels the other. Both test the same main, and a cancelled run reports no result in either direction. We left it alone because changing it is outside this change's scope.
• No changeset: nothing under src/ or in the published package moves.

Harness-Task: 44

🤖 Generated with Claude Code