Add PR CI that runs the example workflow and guards README drift

[Copilot]

There was no CI to validate PRs. Running the sample-app workflow on PRs is a good end-to-end smoke test, but the existing example-app.yml pins actions to @main (so it documents usage) and only triggers on workflow_dispatch, so it never ran automatically and the README copy could silently diverge.

Changes

• example-app.yml: expose workflow_call — adds the trigger (keeps workflow_dispatch) so CI can invoke the documented pipeline as-is. No job/logic changes, so it remains a copy-pasteable example.
• ci.yml (new): pull_request + push:main + workflow_dispatch — permissions: contents: read. Two jobs:
  • docs-drift: diffs the jobs: block of the README's first yaml example against example-app.yml, normalizing the action ref (@v1 vs @main) and blank lines. Fails if they drift.
  • example-app: uses: ./.github/workflows/example-app.yml to run build-matrix → analyze → workflow-summary end to end.

jobs:
  docs-drift:
    # diff README example jobs vs example-app.yml (ref-normalized)
  example-app:
    needs: docs-drift
    uses: ./.github/workflows/example-app.yml

Security

• Uses pull_request, not pull_request_target — fork PRs run with a read-only token and no secrets, so malicious PR input cannot exfiltrate secrets or gain write access.
• contents: read only; the example's write-capable inputs (requestGitHubAnalysis, uploadToCodeScanning) stay off by default.
• Relies on the default fork-PR approval gate for first-time contributors.

Known tradeoff

Because example-app.yml references actions at @main (to stay valid as docs), the example-app job validates PR action-code (analyze/, build-matrix/, workflow-summary/) only on push:main, not on the PR itself; PR-side coverage is the example structure and README. Closing that gap requires a job with local ./ refs + checkout (more workflow code, slightly more brittle) and can be added if desired.

Note: build-matrix has no continue-on-error, and analyze builds a real CodeQL DB (multi-minute run), so consider this before making the check required.

[felickz]

@copliot

I like the idea that the run on push calls the @main .. but a separate workflow for Cl-PR.yml to account for testing the pr changes.. update our pr