validate regenerated evidence tip in CI

Author: mgrouch

.github/workflows/ou-validation-post-build.yml

@@ -0,0 +1,28 @@
+name: ou-validation-post-build
+
+on:
+  workflow_run:
+    workflows: ["build"]
+    types: [completed]
+
+# Evidence commits are pushed by GITHUB_TOKEN, so their push event does not
+# recursively start CI. workflow_dispatch is explicitly allowed to create a
+# new run from GITHUB_TOKEN, which lets us validate the exact tip that the
+# completed build/evidence pipeline left on main.
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  validate-current-main:
+    if: github.event.workflow_run.head_branch == 'main'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Dispatch smoke validation for the current main tip
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh workflow run ou-validation.yml \
+            --repo "${{ github.repository }}" \
+            --ref main \
+            -f validation_mode=smoke

tests/validation/test_workflow_contract.py

@@ -4,6 +4,9 @@
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
 WORKFLOW = REPO_ROOT / ".github" / "workflows" / "ou-validation.yml"
+POST_BUILD_WORKFLOW = (
+    REPO_ROOT / ".github" / "workflows" / "ou-validation-post-build.yml"
+)
 
 
 class WorkflowContractTests(unittest.TestCase):
@@ -48,6 +51,19 @@ def test_failure_message_cannot_run_after_a_push(self):
         self.assertNotIn("The regenerated bundle is committed, but", workflow)
         self.assertNotIn("Fail if the manuscript no longer matches", workflow)
 
+    def test_completed_main_build_dispatches_smoke_for_current_tip(self):
+        workflow = POST_BUILD_WORKFLOW.read_text(encoding="utf-8")
+        primary = WORKFLOW.read_text(encoding="utf-8")
+
+        self.assertIn("workflow_dispatch:", primary)
+        self.assertIn("workflow_run:", workflow)
+        self.assertIn('workflows: ["build"]', workflow)
+        self.assertIn("head_branch == 'main'", workflow)
+        self.assertIn("actions: write", workflow)
+        self.assertIn("gh workflow run ou-validation.yml", workflow)
+        self.assertIn("--ref main", workflow)
+        self.assertIn("-f validation_mode=smoke", workflow)
+
 
 if __name__ == "__main__":
     unittest.main()