fix(ci): check-commands workflow missing push trigger for staging branch (staging review — PR #1081)

[rapiercraft-forge]

Problem

check-commands.yml only triggers on pull_request events. Direct pushes to staging bypass the native-conflict CI check. The publish.yml workflow has its own guard on push to main, but the standalone check has a gap.

Source: PR #1081 — fix(commands): native conflict resolution and CI guard
Confidence: CONFIRMED
Severity: LOW

Affected Files

1. .github/workflows/check-commands.yml:3 — Add push trigger for staging/main

Source Branch Context

Code branch: staging
Worktree base: origin/staging

Acceptance Criteria

• Finding validated: VALIDATED
• If VALIDATED: fix implemented and tested on correct branch — PR fix(ci): add push trigger for staging/main to check-commands workflow #1093 merged to staging

[rapiercraft-forge]

Phase: Phase 0 — starting pipeline
Timestamp: 2026-06-25T10:09:35Z
Issue: #1086

[rapiercraft-forge]

Phase: Phase 1 — Investigation
Timestamp: 2026-06-25T10:09:53Z
Issue: #1086

[rapiercraft-forge]

Investigation Report

Verdict: CONFIRMED
Confidence: HIGH
Severity: LOW
Task Type: Bug Fix

What Was Claimed

The check-commands.yml CI workflow only triggers on pull_request events for commands/** and scripts/check-native-conflicts.sh paths. Direct pushes to staging (e.g. from merge commits) bypass the native-conflict CI check entirely.

What We Found

Confirmed on origin/staging. The check-commands.yml workflow has only a pull_request trigger:

on:
  pull_request:
    paths:
      - 'commands/**'
      - 'scripts/check-native-conflicts.sh'

The publish.yml workflow does include an inline check-native-conflicts.sh step but only for push to main. The staging branch has no push-based protection — a direct push or squash-merge to staging that adds a conflicting command would not be caught until a PR is opened against main.

Root Cause

When check-commands.yml was added in commit 9b14c71 (PR #1074), it was designed only as a PR-time check. The publish.yml adds protection at the main-push boundary, but the gap between staging push and PR-to-main was left uncovered. Any direct push to staging bypasses the check.

Affected Files

1. .github/workflows/check-commands.yml — Add push trigger for staging and main branches

Evidence

• origin/staging:.github/workflows/check-commands.yml — only pull_request trigger, no push trigger
• origin/staging:.github/workflows/publish.yml — has push: branches: [main] with inline conflict check step
• Commit 9b14c71 introduced the workflow without a push trigger for staging

Recommendation

Add a push trigger to check-commands.yml for both staging and main branches (with the same paths filter). This closes the gap for direct pushes. The main coverage is partially redundant with publish.yml but adds defense-in-depth and runs faster (no npm publish overhead).

Related Issues

• feat(scripts): add CI check to prevent ForgeDock commands from shadowing native Claude Code commands #1074 — feat(scripts): add CI check to prevent native Claude Code command shadowing (origin of this workflow)

Decomposition Assessment

NO — Single-file, single-trigger change. No decomposition needed.

[rapiercraft-forge]

{"phase": "INVESTIGATION", "status": "COMPLETE", "next_phase": "BUILD", "timestamp": "2026-06-25T10:10:43Z"}

[rapiercraft-forge]

Phase: Phase 3 — Build
Timestamp: 2026-06-25T10:10:53Z
Issue: #1086

[rapiercraft-forge]

Fast-Path Classification

COMPLEXITY_BAND: TRIVIAL
Task type: Bug Fix
Affected file count: 1
Rationale: Single YAML workflow file, adding a push trigger — no logic changes, config/CI-only edit.
Phases skipped: 3C.5, 3C.6

[rapiercraft-forge]

Builder Contract

Task type: Bug Fix

Proposed Approach

Add a push trigger to .github/workflows/check-commands.yml for the staging branch (and optionally main for defense-in-depth) with the same paths filter already used by the pull_request trigger. This ensures that direct pushes to staging — including squash-merges from PRs — also run the native-conflict check.

Deliverables

File	Change	Why
.github/workflows/check-commands.yml	Add push: branches: [staging, main] block with paths filter	Closes gap for direct pushes to staging that bypass PR-only trigger

Acceptance Criteria

• check-commands.yml has a push trigger covering staging (and main) with the same commands/** / scripts/check-native-conflicts.sh path filter
• Existing pull_request trigger is unchanged
• No other workflow files are modified

Quality Considerations

• No new env vars, secrets, or auth model changes
• Change is purely additive — no risk to existing PR-time check
• Defense-in-depth for main is redundant with publish.yml but harmless

Out of Scope

• Modifying publish.yml
• Any changes to check-native-conflicts.sh itself