From 52d6e57cf9a36a2cdb1e1866170f6c5d3fb7f48d Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Tue, 25 Aug 2026 06:59:30 +0200
Subject: [PATCH 1/3] Compile the tree on a pull request, with warnings as
 errors (#15)

Nothing compiled this repository on a pull request. The checks here read
documents, workflows, shell and the dependency graph, and none of them asked
whether the code builds at all.

The check-run name is exactly build, on both the workflow and the job, which is
the string #26 will require on main. GitHub takes that name from the job's name
and falls back to the job id, and a ruleset matches the literal, so having the two
agree means a rename cannot detach the requirement from the thing it was
requiring without being visible in this file.

The job carries no if: and no path filter, and that is deliberate rather than
omitted. GitHub creates a check run for a job it started and then skipped, with
the same name a job that did the work would carry, so the cheapest thing that
satisfies a name appearing in that list is a workflow that compiles nothing. This
one runs on every pull request and on every push to main, and prints the compiler
it used beside its verdict.

The command it runs is the one README.md gives a contributor rather than a variant
of it, which is #13's third condition.

Warnings are errors, set on the job rather than on the step so that a second step
added later cannot quietly compile without it. That direction was proven before
this landed, with an unused import and the same command:

    RUSTFLAGS="-D warnings" cargo build --locked --all-targets
    error: unused import: `std::collections::HashMap`
      --> src\lib.rs:51:5
       = note: `-D unused-imports` implied by `-D warnings`
    error: could not compile `flowfin-core` (lib) due to 1 previous error

and green again with the import removed. The same proof on the runner follows in
this branch, because a direction proven on one machine is not the direction the
gate has.

The concurrency group is namespaced on the workflow name rather than being the
bare word. A group string two workflows share means the run created second
cancels the other, and the gate that dies that way leaves a green tick beside no
verdict. This board paid for that once already, on #178.

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
---
 .github/workflows/build.yml | 72 +++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 .github/workflows/build.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..9921835
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,72 @@
+# The tree is compiled on a pull request (#15). Nothing did until this landed:
+# the checks here read documents, workflows, shell and the dependency graph, and
+# none of them asked whether the code builds at all.
+#
+# The check-run name is exactly `build`, which is the string #26 will require on
+# main. GitHub takes that name from the job's `name:` and falls back to the job
+# id, and a ruleset matches the literal, so a rename here silently detaches the
+# requirement from the thing it was requiring. Both are `build` on purpose, so
+# neither can drift without the other.
+#
+# THE JOB HAS NO `if:` AND NO PATH FILTER, AND THAT IS THE POINT RATHER THAN AN
+# OMISSION. GitHub creates a check run for a job it started and then skipped, and
+# it carries the same name a job that did the work would, so the cheapest thing
+# that satisfies "the name appears in the list" is a workflow that compiles
+# nothing. This job runs on every pull request and on every push to main, and its
+# log carries the compiler it used.
+#
+# The command is the one README.md gives a contributor, not a variant of it. That
+# is #13's third condition, and a gate running something else is how the two come
+# apart.
+#
+# Warnings are errors from the first commit. A warning backlog is only ever paid
+# down once, and there is no backlog here yet.
+name: build
+
+on:
+  pull_request:
+    branches: ["**"]
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main]
+
+# Deny at the workflow level and grant per job, so a job added later starts with
+# nothing rather than with what this one needs.
+permissions: {}
+
+concurrency:
+  # Namespaced on the workflow name rather than on `build` alone: a group string
+  # two workflows share means the run created second cancels the other, and the
+  # gate that dies that way leaves a green tick beside no verdict. This board has
+  # already paid for that once, on #178.
+  group: build-workflow-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read # check out the tree that is compiled
+    env:
+      # Every warning is an error, for the whole job. Set here rather than on the
+      # step so that a second step added later cannot quietly compile without it.
+      RUSTFLAGS: -D warnings
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Nothing here pushes, so do not leave the token in .git/config.
+          persist-credentials: false
+
+      # Printed rather than assumed. The toolchain is the runner image's until
+      # #14 pins one, so which compiler produced a verdict is a fact of the image
+      # on the day and belongs in the log beside the verdict.
+      - name: Say which toolchain built this run
+        run: |
+          rustc -vV
+          cargo --version
+
+      - name: Build everything
+        run: cargo build --locked --all-targets

From af670ca1dfce9a8345c62ad4acd5080458032202 Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Tue, 25 Aug 2026 07:06:04 +0200
Subject: [PATCH 2/3] Prove the build check refuses a warning, by adding one

The commit after this one takes the import out again. A guard nobody watched fail
is a guard nobody knows the direction of, and the direction was proven on this
machine before the workflow was written rather than only here.

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
---
 src/lib.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/lib.rs b/src/lib.rs
index 957bf77..55548ba 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -48,6 +48,8 @@
 #![forbid(unsafe_code)]
 #![deny(missing_docs)]
 
+use std::collections::HashMap;
+
 pub mod artwork;
 pub mod cache;
 pub mod diagnostics;

From 395152786e1bc7eaea26e17201ba313071b5b9f8 Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Tue, 25 Aug 2026 07:08:12 +0200
Subject: [PATCH 3/3] Take the deliberate warning out again

The commit before this one added an unused import so that the build check could
be watched refusing it. The run it produced is on this pull request, and this
commit restores the tree it was measured against.

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
---
 src/lib.rs | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/lib.rs b/src/lib.rs
index 55548ba..957bf77 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -48,8 +48,6 @@
 #![forbid(unsafe_code)]
 #![deny(missing_docs)]
 
-use std::collections::HashMap;
-
 pub mod artwork;
 pub mod cache;
 pub mod diagnostics;