From 54056e8bab09f3367cfbb8f7ce25a39f33fe1d5f Mon Sep 17 00:00:00 2001
From: whyour <imwhyour@gmail.com>
Date: Mon, 24 Aug 2026 16:24:30 +0800
Subject: [PATCH] fix(ci): build workspace before mounted secret gate

---
 .github/workflows/ql3-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ql3-ci.yml b/.github/workflows/ql3-ci.yml
index bd696298..834786ea 100644
--- a/.github/workflows/ql3-ci.yml
+++ b/.github/workflows/ql3-ci.yml
@@ -1185,6 +1185,8 @@ jobs:
             postgres:18.4-bookworm
       - name: Install workspace dependencies without lifecycle scripts
         run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Build QL3 workspace once
+        run: pnpm run build:packages:ql3
       - name: Verify the backward-compatible offline evidence contract
         run: node --test test/back/ql3PluginPackageSecretBindingKubernetesLiveAudit.test.cjs
       - name: Prove approval, two-replica rotation and missing projection fail-close