CI: a branch's pushes run nothing, its pull request runs once

A branch with an open pull request ran twice per push: once for the push,
once for the pull request. Pushes to main still run the tests and publish
the badges; every other branch is tested by its pull request.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

.gitea/workflows/ci.yml

@@ -1,7 +1,8 @@
 # CI and releases (docs/milestones/R1.md).
-#   A push:            the host tests, with their coverage of lib/. On main, the README's badges
+#   A push to main:    the host tests, with their coverage of lib/, and the README's badges
-#                      are published to the branch `badges`.
+#                      published to the branch `badges`.
-#   A pull request:    the same, then the release firmware and the Debug Build.
+#   A pull request:    the same tests and coverage, then the release firmware and the Debug Build.
+#                      A branch's pushes run nothing by themselves: its pull request runs, once.
 #   A tag v*:          all of it, then a Gitea release with the signed Update File.
 #   Run by hand:       the release of a tag that exists already (the ones from before CI).
 #
@@ -11,7 +12,7 @@
 name: CI
 on:
   push:
-    branches: ['**', '!badges']  # badges holds what CI itself publishes
+    branches: [main]  # other branches are tested by their pull request: one run, not two
     tags: ['v*']
   pull_request:
   workflow_dispatch:

README.md

@@ -26,7 +26,7 @@ The framework is rebuilt with the TLS settings in `platformio.ini` (`custom_sdkc
 
 ## CI and releases
 
-Gitea Actions (`.gitea/workflows/ci.yml`, docs/milestones/R1.md) runs the host tests on every push, and on a pull request also builds the release firmware and the Debug Build: changes reach `main` through pull requests. Pushing a tag `v*` runs all of it and publishes a release on Gitea with:
+Gitea Actions (`.gitea/workflows/ci.yml`, docs/milestones/R1.md) runs the host tests on every push to `main`, and on a pull request also builds the release firmware and the Debug Build: changes reach `main` through pull requests. Pushing a tag `v*` runs all of it and publishes a release on Gitea with:
 
 - `roro9stack-<version>.ota`, the signed Update File;
 - `roro9stack-<version>-factory.bin`, the whole flash image for a first install over USB;

docs/milestones/R1.md

@@ -12,7 +12,7 @@ Until now the tests, the builds, the signing and the flashing all happened on on
 
 | # | Decision |
 |---|---|
-| Q151 | A push, to any branch: the host tests (with their coverage). A pull request: the same and both builds; changes reach `main` through pull requests. A tag `v*`: all of it, then a release. (First: everything on every push, which rebuilt the firmware far more often than anyone looked at it.) |
+| Q151 | A push to `main`: the host tests (with their coverage). A push to another branch: nothing, its pull request is what runs (a branch with an open pull request ran twice, once for each). A pull request: the same and both builds; changes reach `main` through pull requests. A tag `v*`: all of it, then a release. (First: everything on every push, which rebuilt the firmware far more often than anyone looked at it.) |
 | Q152 | **CI signs.** The signing key is the repository secret `OTA_SIGNING_KEY`; a tag push makes a complete, signed release with no manual step (ADR 0008). |
 | Q153 | The Debug Build is built in CI with a token of the runner's own, to prove it compiles, and **isn't published**: it would hand everyone its Debug Console token. |
 | Q154 | Pull requests from forks don't start a run. |