ci: run integration tests on pull requests into main

Author: raederan

.github/workflows/integration.yml

@@ -1,11 +1,16 @@
 # Integration tests against a live test wiki. Credentials come from the
 # INTEGR_TEST_* secrets; where they are unavailable (e.g. forks), the
 # credential fixtures make the tests skip instead of fail.
+#
+# Runs on every pull request into main, so breaking changes surface before the
+# release job (gated separately by required review on the pypi environment)
+# ever starts. No push trigger: a push to main is already covered by the PR
+# that preceded it, so a second run would add nothing.
 
 name: Integration
 
 on:
-  push:
+  pull_request:
     branches: [main]
   workflow_dispatch:
 

docs/dev.md

@@ -62,8 +62,9 @@ excluded by default:
 ### Integration tests
 
 Integration tests run against a live wiki and need credentials; tests
-whose credentials are missing skip instead of fail. CI runs them on
-every push to `main` (workflow `integration.yml`).
+whose credentials are missing skip instead of fail. CI runs them on every
+pull request into `main` (workflow `integration.yml`), so they gate the
+release rather than run after it.
 
 === "make"