A trigger matrix, drawn once, on paper

An afternoon spent working out what actually runs when, which nobody had ever done.

                  push/main  PR   schedule  manual
  tests               ✓        ✓       ✗        ✓
  static analysis     ✗        ✓       ✗        ✗
  migration check     ✗        ✓       ✗        ✗
  deploy              ✓        ✗       ✗        ✓
  docs                ✓        ✗       ✗        ✗
  security scan       ✗        ✗       ✓        ✓

two holes: analysis and the migration check do not run
on a direct push to main, which is permitted for two
people.

A matrix of six jobs and four triggers is twenty-four cells and nobody had ever drawn it, which is why two of them were wrong. The holes were not a design decision — they were the consequence of each workflow being written on its own, and no view existed in which they were visible.