Merge feat/site-stats-countup: count impact figures up on scroll into… #248

	name: '🧪 CI Sanity'

	# =============================================================================
	# Cross-cutting CI hygiene checks
	# =============================================================================
	#
	# Small, fast checks that catch bug classes affecting the CI system itself
	# rather than any single subsystem's content.
	#
	# Current checks:
	# - workflow-fork-safety: ensure no pull_request-triggered workflow
	# references vars.* or (non-GITHUB_TOKEN) secrets.*, since those
	# are not exposed to fork PRs and cause silent build failures.
	#
	# Triggers:
	# - pull_request on changes to .github/
	# - push to dev on changes to .github/
	# - workflow_dispatch for manual runs
	# =============================================================================

	on:
	workflow_dispatch:
	pull_request:
	paths:
	- '.github/**'
	push:
	branches: [dev]
	paths:
	- '.github/**'

	permissions:
	contents: read

	concurrency:
	group: ci-sanity-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	workflow-fork-safety:
	name: '🔐 Workflow fork-safety'
	runs-on: ubuntu-latest
	timeout-minutes: 5

	steps:
	- name: 📥 Checkout
	uses: actions/checkout@v6

	- name: 🐍 Setup Python
	uses: actions/setup-python@v6
	with:
	python-version: ${{ vars.PYTHON_VERSION \|\| '3.12' }}

	- name: 📦 Install PyYAML
	run: pip install pyyaml

	- name: 🔐 Check workflows are safe for fork PRs
	run: python3 .github/scripts/check_workflow_fork_safety.py

Navigation Menu