From fcadf5e4431b1051f9c45bf27bb210568ca02584 Mon Sep 17 00:00:00 2001
From: Roland Groza <rolandjitsu@gmail.com>
Date: Thu, 3 Sep 2026 16:26:59 +0900
Subject: [PATCH] ci: skip redundant runs on main pushes

Main is protected, so PRs are the validation gate: run lint/deny/helm/
typos on pull_request only, and drop package.yml's build from push
(release.yml builds and pushes the real image). Keep test on push to
main so Codecov's project-drop base stays fresh. Skip knope's own
"chore: prepare release" commit in ci/package/release so it triggers
no jobs instead of duplicating a full run.

Assisted-by: Claude:claude-opus-4-8
---
 .github/workflows/ci.yml      | 22 ++++++++++++++++++----
 .github/workflows/package.yml |  9 ++++-----
 .github/workflows/release.yml |  6 ++++++
 3 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b9e4c5c..b362fde 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,8 +11,14 @@ env:
 
 jobs:
   # Gate the Rust jobs on Rust changes, so docs-only changes skip lint and test.
+  # `main` is protected (PR-only), so validation is the PR's job; on push to main
+  # only `test` re-runs (for the Codecov base, below). Skip the whole workflow on
+  # knope's own release-bump commit - it re-pushes to main and would otherwise
+  # duplicate everything. `head_commit` is null on pull_request events, so this
+  # guard only ever suppresses that one push.
   changes:
     name: Detect changes
+    if: "${{ !startsWith(github.event.head_commit.message, 'chore: prepare release') }}"
     runs-on: ubuntu-latest
     outputs:
       rust: ${{ steps.filter.outputs.rust }}
@@ -36,7 +42,8 @@ jobs:
   lint:
     name: Lint
     needs: changes
-    if: needs.changes.outputs.rust == 'true'
+    # PR-only: a merge lands the exact tree already linted on the PR.
+    if: github.event_name == 'pull_request' && needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -52,6 +59,10 @@ jobs:
   test:
     name: Test and coverage
     needs: changes
+    # The one job that also runs on push to main: it re-uploads coverage so
+    # Codecov's project base (codecov.yml `project: auto`, 0% drop) tracks the
+    # merged main, not a stale ancestor. The knope commit is already excluded via
+    # `changes` above (a version bump does not change coverage anyway).
     if: needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     steps:
@@ -81,7 +92,8 @@ jobs:
   deny:
     name: Dependencies
     needs: changes
-    if: needs.changes.outputs.rust == 'true'
+    # PR-only: the dependency tree that merges is the one already scanned.
+    if: github.event_name == 'pull_request' && needs.changes.outputs.rust == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -94,7 +106,8 @@ jobs:
   helm:
     name: Lint and validate Helm chart
     needs: changes
-    if: needs.changes.outputs.helm == 'true'
+    # PR-only: a merge lands the exact chart already validated on the PR.
+    if: github.event_name == 'pull_request' && needs.changes.outputs.helm == 'true'
     runs-on: ubuntu-latest
     env:
       # kubeconform release used to validate rendered manifests against the
@@ -129,9 +142,10 @@ jobs:
               | kubeconform -strict -summary -ignore-missing-schemas
           done
 
-  # Spelling runs on everything, including docs.
+  # Spelling runs on every PR, including docs. PR-only: a merge lands the same tree.
   typos:
     name: Typos
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 94c29b2..e25df80 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -1,12 +1,11 @@
 name: Package
 
-# On every packaging change, build the image (no push) so breakage is caught before a
-# release. Publishing the versioned image to GHCR happens in the Release workflow, in the
-# same run that cuts the release.
+# On a packaging change in a PR, build both arches (no push) so breakage is caught before
+# merge. Building and pushing the versioned image to GHCR happens in the Release workflow,
+# so there is nothing to build on push to main here (main is protected, so the merged tree
+# is the one already built on the PR).
 
 on:
-  push:
-    branches: [main]
   pull_request:
 
 permissions:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 265ac77..3012f8f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,6 +24,12 @@ env:
 jobs:
   release:
     name: Release
+    # knope re-pushes its own version-bump commit to main, which retriggers this
+    # workflow; that rerun would only find no releasable commits and no-op. Skip it
+    # outright so it does not even spin a runner. Every other push (a merged PR)
+    # still runs and releases if there are releasable commits. The publish-* jobs
+    # need this job, so they cascade-skip on the bump commit too.
+    if: "${{ !startsWith(github.event.head_commit.message, 'chore: prepare release') }}"
     runs-on: ubuntu-latest
     permissions:
       contents: write