diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml
index 7592551..85310bd 100644
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -5,11 +5,14 @@
 #   1. shellcheck   — lint all .sh files (warnings+errors)
 #   2. duplicate-detection — report copy-pasted code blocks (non-blocking)
 
+when:
+  event: [push, pull_request]
+
 steps:
   - name: shellcheck
     image: koalaman/shellcheck-alpine:stable
     commands:
-      - find . -name "*.sh" -not -path "./.git/*" -print0 | xargs -0 shellcheck --severity=warning
+      - find . -name "*.sh" -not -path "./.git/*" -print0 | xargs -0 -r shellcheck --severity=warning
 
   - name: duplicate-detection
     image: python:3-alpine
diff --git a/.woodpecker/detect-duplicates.py b/.woodpecker/detect-duplicates.py
index 4124a40..caf6012 100644
--- a/.woodpecker/detect-duplicates.py
+++ b/.woodpecker/detect-duplicates.py
@@ -27,11 +27,11 @@ MIN_FILES = int(os.environ.get("DUP_MIN_FILES", "2"))
 ANTI_PATTERNS = [
     (
         r'"\$CI_STATE"\s*=\s*"success"',
-        'Hardcoded CI_STATE="success" check — use ci_passed() from dev-poll.sh instead',
+        'Hardcoded CI_STATE="success" check — extract ci_passed() to lib/ and call it here',
     ),
     (
-        r'\$CI_STATE\s*!=\s*"success"',
-        'Hardcoded CI_STATE!="success" check — use ci_passed() from dev-poll.sh instead',
+        r'"?\$CI_STATE"?\s*!=\s*"success"',
+        'Hardcoded CI_STATE!="success" check — extract ci_passed() to lib/ and call it here',
     ),
     (
         r'WOODPECKER_REPO_ID\s*=\s*[1-9][0-9]*',
diff --git a/review/review-poll.sh b/review/review-poll.sh
index a586b30..c24eb4b 100755
--- a/review/review-poll.sh
+++ b/review/review-poll.sh
@@ -59,7 +59,7 @@ while IFS= read -r line; do
   # Skip if CI is running/failed. Allow "success" or no CI configured (empty/pending with no pipelines)
   if [ "$CI_STATE" != "success" ]; then
     # Projects without CI (woodpecker_repo_id=0) treat empty/pending as pass
-    if [ "${WOODPECKER_REPO_ID:-2}" = "0" ] && [ "$CI_STATE" = "" ] || [ "$CI_STATE" = "pending" ]; then
+    if [ "${WOODPECKER_REPO_ID:-2}" = "0" ] && { [ "$CI_STATE" = "" ] || [ "$CI_STATE" = "pending" ]; }; then
       : # no CI configured, proceed to review
     else
       log "  #${PR_NUM} CI=${CI_STATE}, skip"