From 7f73de76ac0e54327745cad61043922047c421ec Mon Sep 17 00:00:00 2001
From: codex-bot <codex-bot@ksv741.ru>
Date: Mon, 2 Nov 2026 20:36:58 +0300
Subject: [PATCH] ci: check whitespace in committed PR/push range
 (WealthLedger/specs#2)

verify ran git diff --check on a clean checkout (always no-op). Now checks PR merge-base..head or push before..after; zero before falls back to the last commit. Node setup removed from the git-only job.
---
 .gitea/workflows/verify.yml | 22 ++++++++++++++++++----
 README.md                   |  7 +++++--
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/verify.yml b/.gitea/workflows/verify.yml
index cd6d109..d793b91 100644
--- a/.gitea/workflows/verify.yml
+++ b/.gitea/workflows/verify.yml
@@ -15,8 +15,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/actions/setup-node@v4
         with:
-          node-version-file: .nvmrc
-      - run: npm ci
-      - run: npm run verify
+          fetch-depth: 0
+      - name: Check whitespace in committed range
+        env:
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE: ${{ github.event.before }}
+          PUSH_AFTER: ${{ github.sha }}
+        run: |
+          if [ -n "$PR_HEAD" ]; then
+            range="$PR_BASE...$PR_HEAD"
+          elif [ -n "$PUSH_BEFORE" ] && ! expr "$PUSH_BEFORE" : '0*$' >/dev/null; then
+            range="$PUSH_BEFORE..$PUSH_AFTER"
+          else
+            # New branch / unknown before: only the pushed commit; full tree would hit read-only archives.
+            range="$PUSH_AFTER^..$PUSH_AFTER"
+          fi
+          echo "Checked revision: $(git rev-parse HEAD); range: $range"
+          git diff --check "$range"
diff --git a/README.md b/README.md
index 600f9c1..f30829e 100644
--- a/README.md
+++ b/README.md
@@ -33,8 +33,11 @@ CLI и доступность store, и при расхождении вывод
 validation не заменяет semantic verification и independent read-only review перед archive.
 
 Node задаётся собственной `.nvmrc`; после `nvm use --silent` выполните `npm ci`.
-`npm run verify` проверяет diff. OpenSpec validation остаётся отдельной проверкой
-при изменениях требований. История релизов — [CHANGELOG](CHANGELOG.md).
+`npm run verify` локально проверяет whitespace в незакоммиченном diff; CI `verify`
+выполняет тот же `git diff --check` по коммитам PR (merge-base→head) или push
+(before→after, для новой ветки — последний коммит). Это структурная проверка
+whitespace, не semantic spec validation. OpenSpec validation остаётся отдельной
+проверкой при изменениях требований. История релизов — [CHANGELOG](CHANGELOG.md).
 
 ## Релизы