Findings No. 49
Pushes made with `GITHUB_TOKEN` trigger no workflows, so the check has to run before the push
Commits pushed with the default GITHUB_TOKEN create no workflow runs, so CI never saw the daily data commits. The check now runs inside the refresh, before the push.
When a GitHub Actions workflow pushes a commit using the default GITHUB_TOKEN, GitHub does not start any workflows for that commit. This is deliberate, to prevent workflows from triggering each other in loops, but it means your CI never sees what the bot pushed.
The CCRTA website refreshes its transit data with a daily workflow that pushes using GITHUB_TOKEN. We had added a regression test to ci.yml that sweeps every route color in that data for contrast. It had never run on a single data commit, which are exactly the commits that change what it checks. We confirmed it through GitHub's API: the bot's commits had no check runs at all.
The fix moved the test into the refresh workflow itself, between regenerating the data and pushing it. If it fails, nothing is pushed: the site keeps yesterday's valid data, and the failed run is the signal. The step runs only the contrast test file, so an unrelated flaky test cannot block the daily refresh.
The general rule: a check that has to guard changes pushed by a bot must run inside the workflow that pushes them, before the push. Otherwise bad data ships first and the failure lands later on some unrelated pull request.
Receipt: CCRTA Website commit 64838d9 (.github/workflows/refresh-gtfs.yml; FINDINGS.md, "CI / GitHub Actions").