ci: ensure required checks run for every pull request

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ on:
       - 'tests/**'
   pull_request:
     branches: [main]
-    paths: *ci_paths
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -120,7 +119,6 @@ jobs:
       - name: Open PR for auto-fixes if any
         id: create-pr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
-        continue-on-error: true
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: docs/evidence-urls.json
@@ -130,8 +128,8 @@ jobs:
             The scheduled external-contract monitor detected and refreshed
             stale verification timestamps in `docs/evidence-urls.json`.
 
-            This automated change is submitted as a pull request so protected
-            `main` remains compliant with signed-commit requirements.
+            This automated change is submitted as a pull request so required
+            checks and review remain in the normal protected-branch workflow.
           branch: automation/external-contract-drift
           delete-branch: true
       - name: Check research expiry and create issues

docs/evidence-urls.json

@@ -10,7 +10,7 @@
       ],
       "max_redirects": 0,
       "source_section": "README and skill frontmatter",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "Claude Code skills documentation",
@@ -20,7 +20,7 @@
       ],
       "max_redirects": 0,
       "source_section": "references/platform-locations.md",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "Codex skills documentation",
@@ -31,7 +31,7 @@
       "max_redirects": 0,
       "canonical_url": "https://learn.chatgpt.com/docs/build-skills",
       "source_section": "references/platform-locations.md",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "Cursor skills documentation",
@@ -42,7 +42,7 @@
       "max_redirects": 0,
       "canonical_url": "https://cursor.com/docs/skills",
       "source_section": "references/platform-locations.md",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "Gemini CLI skills documentation",
@@ -52,7 +52,7 @@
       ],
       "max_redirects": 0,
       "source_section": "references/platform-locations.md",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "GitHub Copilot agent skills documentation",
@@ -62,7 +62,7 @@
       ],
       "max_redirects": 0,
       "source_section": "references/platform-locations.md",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "GitHub code search documentation",
@@ -72,7 +72,7 @@
       ],
       "max_redirects": 0,
       "source_section": "references/catalog-contracts.md",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "OpenCode skills documentation",
@@ -82,7 +82,7 @@
       ],
       "max_redirects": 0,
       "source_section": "references/platform-locations.md",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "skills.sh",
@@ -92,7 +92,7 @@
       ],
       "max_redirects": 1,
       "source_section": "references/catalog-contracts.md",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "skills.sh API documentation",
@@ -102,7 +102,7 @@
       ],
       "max_redirects": 0,
       "source_section": "references/catalog-contracts.md",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "skills.sh authenticated search contract",
@@ -113,7 +113,7 @@
       "max_redirects": 0,
       "source_section": "references/catalog-contracts.md",
       "notes": "An anonymous request should be rejected; authenticated response shape is documented by the provider.",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "CrossAITools listing API",
@@ -128,7 +128,7 @@
         "type": "array"
       },
       "source_section": "historical research monitoring",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     },
     {
       "name": "Mercury Skills listing API",
@@ -146,7 +146,7 @@
         ]
       },
       "source_section": "historical research monitoring",
-      "last_verified": "2026-08-17"
+      "last_verified": "2026-08-24"
     }
   ]
 }

scripts/validate-ci.py

@@ -103,8 +103,10 @@ def validate_workflow(workflow: str) -> list[str]:
             errors.append("ci.yml: shared workflow paths must include tests/**")
     if pull_request is None:
         errors.append("ci.yml: missing pull_request event")
-    elif not re.search(r"(?m)^\s*paths:\s*\*ci_paths\s*$", pull_request):
-        errors.append("ci.yml: pull_request paths must reuse the ci_paths anchor")
+    # Required branch-protection checks must run for every PR. A path filter
+    # here can skip the workflow and leave required checks pending forever.
+    elif re.search(r"(?m)^\s*paths:\s*", pull_request):
+        errors.append("ci.yml: pull_request must not use paths filters")
 
     # Lint job
     lint = section_body(active, "lint")