fix(ci): add push trigger for staging/main to check-commands workflow

[rapiercraft-forge]

Summary

Adds a push trigger to check-commands.yml so the native-conflict check runs on direct pushes to staging and main, not only on pull request events.

Previously, direct pushes to staging (e.g. squash-merges) bypassed the CI guard added in #1074. The publish.yml workflow covers push to main with an inline step, but staging had no push-based protection.

Changes

• .github/workflows/check-commands.yml — Added push: branches: [staging, main] trigger with the same paths filter (commands/**, scripts/check-native-conflicts.sh) as the existing pull_request trigger

Testing

• Push a change to commands/ directly to staging — confirm check-native-conflicts job triggers [type:manual]
• Verify PR-based trigger still fires on pull_request events [type:manual]

---

Closes #1086
Implementation branch: fix/check-commands-push-trigger-1086
Base: staging

[rapiercraft-forge]

APPROVED: commit 17aa8e3 after context-aware review (2 agents: Security + Infrastructure). 0 findings created. Safe to merge.

Review Details

Reviewed commit: 17aa8e3 | Domains: Infrastructure/CI | Agents: 2 (Security, Infrastructure)

Automated Checks

Check	Result
Secrets detection	✅ PASS — no credentials in diff
Env var audit	✅ PASS — no new env vars
Python compile	⏭ SKIPPED — no Python files
TypeScript build	⏭ SKIPPED — no TS files
SQL migration	⏭ SKIPPED — no SQL files
Builder contract scope	✅ PASS — PR changes exactly the contracted file
Sibling workflow drift	✅ PASS — no shared jobs across workflows
Integration assumptions	✅ PASS — additive trigger, no activation path risk

Security Assessment

• No write permissions or GITHUB_TOKEN usage in the job — read-only execution
• The check-native-conflicts.sh script is a pure file-scan with no network access, external calls, or side effects
• Push trigger is path-filtered to commands/** and scripts/check-native-conflicts.sh — no noise risk

Infrastructure Assessment

• The change is purely additive (7 lines, no deletions)
• Paths filter is identical to the existing pull_request trigger — consistent coverage
• main push coverage is redundant with publish.yml inline step but adds defense-in-depth (runs without npm publish overhead)
• No container restarts, no stateful services affected

Findings

None — clean review.

[rapiercraft-forge]

PR Review Summary: #1093 — fix(ci): add push trigger for staging/main to check-commands workflow

Review Integrity

Reviewed commit: `17aa8e3` | Current HEAD: `17aa8e3` | Status: CURRENT

Verdict: APPROVED

Context-Aware Review

Domains: Infrastructure/CI | Agents: 2 (Security, Infrastructure)

Integration Checks (Phase 2.5)

Code registration: ✅ PASS — additive YAML trigger, no activation path risk
SOPS deploy chain: ⏭ N/A — no env var or secret changes
Purpose Regression Gate (7A): N/A — non-milestone PR

Risk Matrix

Category	Risk	Blocking?	Confidence
Workflow push trigger	LOW	No	HIGH
Permission escalation	NONE	No	HIGH
Script safety	NONE	No	HIGH

Findings

None — clean review.

Automated Checks

Check	Result
Secrets detection	✅ PASS
Env var audit	✅ PASS
Python compile	⏭ SKIPPED — no Python files
TypeScript build	⏭ SKIPPED — no TS files
SQL migration	⏭ SKIPPED — no SQL files
Builder contract scope	✅ PASS
Sibling workflow drift	✅ PASS
Merge conflict check	✅ PASS — MERGEABLE

Recommendation

Clean additive change. PR merged to `staging`.

---

Context-aware review complete. 2 agents + integration checks. 0 findings triaged.

[rapiercraft-forge]

Graph Decision Record — Issue #1086 / PR #1093

{
  "schema_version": "1",
  "issue": 1086,
  "pr": 1093,
  "repo": "RapierCraftStudios/forgedock",
  "lane": "fast-lane",
  "pr_base": "staging",
  "branch": "fix/check-commands-push-trigger-1086",
  "head_sha": "17aa8e375bda2217bbc73880caff955045abb73f",
  "merge_commit": "2ccd8f97fc77c798e97438c50d3236f2d57e5d63",
  "investigation": {
    "verdict": "CONFIRMED",
    "confidence": "HIGH",
    "task_type": "Bug Fix"
  },
  "context": {
    "historical_edges_referenced": 0,
    "forge_annotations_read": ["FORGE:INVESTIGATOR", "FORGE:CONTRACT", "FORGE:BUILDER"]
  },
  "build": {
    "files_changed": 1,
    "quality_gate": "skipped",
    "quality_gate_iterations": 0
  },
  "review": {
    "verdict": "APPROVED",
    "findings_created": 0,
    "agents_run": 2
  },
  "merge": {
    "merged_at": "2026-06-25T10:16:25Z",
    "justification": "Investigation confirmed (CONFIRMED/HIGH), additive YAML change, security review passed, no blocking findings"
  }
}

Queryable: gh api repos/RapierCraftStudios/forgedock/issues/1093/comments --jq '[.[] | select(.body | contains("FORGE:DECISION_RECORD"))] | .[0].body