ci: a commit that passed the checks isn't checked again

A fast-forward merge brings the commit a branch's push checked to main
unchanged, and CI ran every check a second time before deploying it. The
check job now marks every commit that passed in the runner's home
(checked/, kept 90 days), and a commit marked already skips straight to
its deploy; the sandbox check still runs every time. Only pushes run CI,
so only those who may push can leave a mark.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

.forgejo/workflows/ci.yaml

@@ -1,6 +1,7 @@
 # CI: every push runs the checks of the pre-push hook (tool/check.sh); a push to main is
 # then deployed to learn.halkyon.eu (deploy/redeploy.sh). Both jobs run on the runner on
-# sahaquiel, directly on the host as an unprivileged user (deploy/runner/).
+# sahaquiel, directly on the host as an unprivileged user (deploy/runner/). A commit
+# that passed the checks before isn't checked again (see "Checked before?").
 #
 # Pushes only, no pull requests: a pull request from a fork would run its own code on
 # the production server's runner.
@@ -44,7 +45,19 @@ jobs:
           fi
           echo "This job can neither see nor reach production."
 
+      # A commit that passed this job before isn't checked again: a fast-forward merge
+      # brings the commit a branch's push checked to main unchanged, and only its deploy
+      # is new. The marks live in the runner's home; only pushes run this workflow, so
+      # only those who may push can leave one. Every later step of this job asks.
+      - name: Checked before?
+        run: |
+          if [ -e "$HOME/checked/${{ github.sha }}" ]; then
+            echo "${{ github.sha }} passed these checks before; they aren't run again."
+            echo 'CHECKED_BEFORE=true' >> "$FORGEJO_ENV"
+          fi
+
       - name: Check out
+        if: env.CHECKED_BEFORE != 'true'
         env:
           TOKEN: ${{ github.token }}
         run: |
@@ -58,6 +71,7 @@ jobs:
           git clean -q -ffdx
 
       - name: Flutter
+        if: env.CHECKED_BEFORE != 'true'
         run: |
           sdk="$HOME/sdk/flutter-$FLUTTER_VERSION"
           if [ ! -x "$sdk/bin/flutter" ]; then
@@ -81,12 +95,14 @@ jobs:
       # second goes through. Drop it once the Dart of FLUTTER_VERSION has pub's fix
       # (ebba0dc, pull request 4914).
       - name: Dependencies
+        if: env.CHECKED_BEFORE != 'true'
         run: flutter pub get --enforce-lockfile || flutter pub get --enforce-lockfile
 
       # The generated code (the server's lib/src/generated, the client package) is
       # committed, so it has to be exactly what the generator makes of the models and
       # endpoints: a model changed without regenerating fails here.
       - name: Generated code
+        if: env.CHECKED_BEFORE != 'true'
         run: |
           bin="${XDG_STATE_HOME:-$HOME/.local/state}/Dart/install/bin"
           if ! "$bin/serverpod" --no-analytics version 2>/dev/null | grep -qx "Serverpod version: $SERVERPOD_VERSION"; then
@@ -104,6 +120,7 @@ jobs:
       # Throwaway and new for every job: they only guard the test database the job creates
       # in its own checkout.
       - name: Test passwords
+        if: env.CHECKED_BEFORE != 'true'
         run: |
           for name in SERVERPOD_DATABASE_PASSWORD \
             SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper \
@@ -112,8 +129,17 @@ jobs:
           done
 
       - name: Checks
+        if: env.CHECKED_BEFORE != 'true'
         run: tool/check.sh
 
+      # Reached only when every step above passed. Marks older than 90 days go.
+      - name: Remember the commit
+        if: env.CHECKED_BEFORE != 'true'
+        run: |
+          mkdir -p "$HOME/checked"
+          touch "$HOME/checked/${{ github.sha }}"
+          find "$HOME/checked" -type f -mtime +90 -delete
+
   deploy:
     needs: check
     if: github.ref == 'refs/heads/main'