From 714d2570588653c82afb39fa9a2bd1c6c06e9e9f Mon Sep 17 00:00:00 2001
From: Codex Bot <codex-bot@gitea.entroia.local>
Date: Fri, 30 Oct 2026 03:43:57 +0800
Subject: [PATCH] ci: restrict workflows to main branch

---
 .gitea/workflows/README.md | 9 ++++-----
 .gitea/workflows/ci.yml    | 3 +--
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/README.md b/.gitea/workflows/README.md
index ad95553..f7b43d8 100644
--- a/.gitea/workflows/README.md
+++ b/.gitea/workflows/README.md
@@ -1,6 +1,6 @@
 # Tessera GUI workflows
 
-[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md).
+[ci.yml](ci.yml) verifies this project on main pushes and manual dispatch from main. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md).
 
 There is no production service deployment in this workflow.
 
@@ -21,17 +21,16 @@ fractional scale, multiline bounds, Unicode truncation and antialiased opacity.
 ## Incremental verification
 
 Gitea 1.26 concurrency groups cancel superseded runs on the same ref. Markdown-only
-pushes and pull requests skip verification; executable Endor examples and Rust
+pushes to main skip verification; pull requests do not trigger this workflow; executable Endor examples and Rust
 files (including embedded guide strings) still trigger checks. Manual dispatch
-always runs verification. Existing queued runs created from older workflow
+runs verification only when main is selected. Existing queued runs created from older workflow
 revisions retain their old behavior.
 
 The workflow invokes [verify-ci.sh](../../scripts/verify-ci.sh). Docker builds the
 Rust 1.91.1/system/font toolchain from Dockerfile.ci over stdin, without sending a
 source build context. The checkout is mounted read-only at /build. Named volumes
 persist Cargo registry/git downloads and /cargo-target across container removal,
-including failed tests and cancelled runs. Main/manual runs and each PR have
-separate cache scopes. Changing Rust/toolchain compatibility requires updating
+including failed tests and cancelled runs. Main push and manual runs use the main cache scope. Changing Rust/toolchain compatibility requires updating
 the image and cache prefix in the script. Cargo lockfiles and fingerprints decide
 which dependencies/artifacts are reusable; caches do not bypass checks.
 
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 49de6dc..a7a3be0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -4,8 +4,6 @@ on:
   push:
     branches: [main]
     paths-ignore: ["**/*.md"]
-  pull_request:
-    paths-ignore: ["**/*.md"]
   workflow_dispatch:
 
 concurrency:
@@ -14,6 +12,7 @@ concurrency:
 
 jobs:
   verify:
+    if: gitea.ref == 'refs/heads/main'
     runs-on: ces-control
     timeout-minutes: 60
     env: