Four years of adding a workflow per concern, consolidated into one file with jobs.
ci.yml tests, on push and pull_request
analyse.yml static analysis, on pull_request
deploy.yml on push to main
docs.yml on push to main, paths: docs/**
security.yml on schedule
what was duplicated: checkout and PHP setup, four
times, three of them subtly different.
what was impossible to see: that analyse.yml did not
run on push to main, so a direct commit skipped it.The concurrency model and the permissions become expressible once everything is in one file, and the gap — analysis not running on direct pushes — was invisible while the triggers were spread across five files. The scheduled security job stayed separate, because a scheduled trigger in a file full of push triggers is genuinely confusing.