ci: run verify-stack only on push to main, not on PRs (refs #182 )

The runner shares the lab node with the deployed stack; a second full stack per PR is what got it OOM-killed. PRs keep every other job as the merge gate. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
fix(k8s): keep Keycloak's backchannel URLs https behind the labs Caddy (refs #177 ) (#180 )
2026-09-25 14:46:59 +02:00 · 2026-09-25 12:30:15 +00:00
2 changed files with 7 additions and 1 deletions
@@ -207,8 +207,14 @@ jobs:
  # dispatched (gitea-actions-gotchas.md §7). Default `if: success()` dispatches normally. Cost: a
  # failing mutation ratchet now skips verify-stack instead of running it anyway; the fix-and-re-push
  # re-run exercises verify-stack, so we still get the signal.
  #
  # Main only, not on PRs: the runner shares the lab node with the deployed stack, and a second
  # full stack per PR was what got the runner OOM-killed (#182). PRs still gate on every job above;
  # the live-stack check runs once per merge. A plain event `if` keeps the implicit success(), so it
  # is not the status-function case from gotchas §7.
  verify-stack:
    needs: [mutation]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: https://github.com/actions/checkout@v4
@@ -21,7 +21,7 @@ and CI cannot drift:
 | `frontend` | `make frontend` → Nx lint/test/build for the four portals | pnpm + Node |
 | `k8s` | `make k8s-lint` (render + schema-check the Helm chart) → `make k8s-drift` (chart still describes the same stack as `infra/docker-compose.yml`) | pinned `helm` binary + `docker compose` |
 | `mutation` | `make mutation` → `dotnet tool restore` → `dotnet stryker` (ACL); uploads the HTML report as an artifact | .NET 10 SDK |
-| `verify-stack` | the single live-stack stage — steps: `make verify-up` (full stack up + health, the DoD smoke) → `make verify-acl` (ACL ↔ OpenZaak) → `make verify-nrc` (OpenZaak → NRC delivery) → `make down` | container engine + egress (base images, nuget, `selectielijst.openzaak.nl`) |
+| `verify-stack` | **push to `main` only, skipped on PRs** (#182) — the single live-stack stage — steps: `make verify-up` (full stack up + health, the DoD smoke) → `make verify-acl` (ACL ↔ OpenZaak) → `make verify-nrc` (OpenZaak → NRC delivery) → `make down` | container engine + egress (base images, nuget, `selectielijst.openzaak.nl`) |
 > **Why one `verify-stack` job, not three.** The single self-hosted runner runs jobs
 > **sequentially**, so booting OpenZaak once (instead of once per check) is the