Run the gates on a tag, so beta criterion 2 can be satisfied (#833)

.github/workflows/ci.yml

@@ -24,6 +24,19 @@ name: build and test
 on:
   push:
     branches: [main]
+    # Tags too, because the beta 1 entry test in design/RELEASE_PLAN_1.0.md asks
+    # for a green matrix "on the tag itself, not on a branch", and nothing here
+    # fired on a tag: v1.0-dev has no workflow run at all, and the runs against
+    # v1.0-alpha and v1.0-alpha2 are push-to-main runs that happen to share the
+    # commit. A criterion satisfiable only by remembering to dispatch one by hand
+    # is not a gate. actions/checkout takes the triggering ref, so this run is
+    # the tag's own.
+    #
+    # The duplicate run against a commit already built on main is the point
+    # rather than waste: it is what binds a green result to the release
+    # artifact. The concurrency group below keys on github.ref, and a tag ref is
+    # not refs/heads/main, so the two do not cancel each other.
+    tags: ['v*']
   pull_request:
   workflow_dispatch:
 

.github/workflows/nightly.yml

@@ -17,6 +17,18 @@
 name: nightly deep gate
 
 on:
+  # A tag runs the deep gate as well as the per-PR one. Beta 1 criterion 2 names
+  # both this workflow's matrix and its sanitizer gate, and asks for them green
+  # on the tag; a schedule cannot deliver that, because the nightly that follows
+  # a tag runs against whatever main holds by then.
+  #
+  # concurrency below is group: nightly with cancel-in-progress: false, so a tag
+  # run queues behind a scheduled one instead of killing it. The per-job
+  # `if: github.event_name == 'workflow_dispatch' || github.repository == ...`
+  # guards already admit a push on the canonical repository, so they need no
+  # change: a tag push there satisfies the second clause, and a fork still skips.
+  push:
+    tags: ['v*']
   schedule:
     - cron: "0 6 * * *" # nightly, 06:00 UTC
   workflow_dispatch: