From a959b1d6b47589586440f1b21ff638017c9620df Mon Sep 17 00:00:00 2001
From: "jason.woltje" <jason@diversecanvas.com>
Date: Sun, 12 Jul 2026 22:48:58 +0000
Subject: [PATCH] ci: restrict push-event CI to protected branches (halve
 feature-branch load) (#721)

---
 .woodpecker/ci.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml
index ce4d4da..1789aa8 100644
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -7,7 +7,14 @@ variables:
   - &enable_pnpm 'corepack enable'
 
 when:
-  - event: [push, pull_request, manual]
+  # PR + manual CI run on any branch — the pull_request pipeline is the merge gate.
+  # push CI is restricted to protected branches (main) so a feature-branch push no
+  # longer fires a redundant SECOND pipeline alongside its PR pipeline. This ~halves
+  # CI load on the storage-constrained runner with zero loss of gating (branch
+  # protection requires no push/ci status context; main still gets full push CI).
+  - event: [pull_request, manual]
+  - event: push
+    branch: main
 
 # Turbo remote cache (turbo.mosaicstack.dev) is configured via Woodpecker
 # repository-level environment variables (TURBO_API, TURBO_TEAM, TURBO_TOKEN).