ci: restrict push-event CI to protected branches (halve feature-branch load) #721

2026-07-12T22:19:26Z

jason.woltje commented

2026-07-12 22:19:26 +00:00

Every feature-branch push currently triggers two Woodpecker pipelines — ci/woodpecker/push/ci and ci/woodpecker/pr/ci — doubling load on the storage-constrained (spinning-disk) runner.

The push run on feature branches is redundant: the pull_request pipeline is the merge gate. This change runs push CI only on main, while PR + manual CI still run on every branch.

~halves feature-branch CI load (one pipeline per push instead of two)
zero loss of gating — main branch protection requires no push/ci status context (verified enable_status_check: false); main still gets full push CI on merge

Approved by Jason 2026-07-12 to relieve the queue while the SSD is pending.

🤖 Generated with Claude Code

Every feature-branch push currently triggers **two** Woodpecker pipelines — `ci/woodpecker/push/ci` and `ci/woodpecker/pr/ci` — doubling load on the storage-constrained (spinning-disk) runner. The push run on feature branches is redundant: the **pull_request** pipeline is the merge gate. This change runs push CI **only on `main`**, while PR + manual CI still run on every branch. - ~halves feature-branch CI load (one pipeline per push instead of two) - zero loss of gating — `main` branch protection requires no `push/ci` status context (verified `enable_status_check: false`); `main` still gets full push CI on merge Approved by Jason 2026-07-12 to relieve the queue while the SSD is pending. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jason.woltje added 1 commit 2026-07-12 22:19:26 +00:00

ci: restrict push-event CI to protected branches (main)

ci/woodpecker/pr/ci Pipeline was successful

Details

5c7aaac955

Every feature-branch push currently fires TWO pipelines — a push CI and a
pull_request CI — doubling load on the storage-constrained (spinning-disk)
Woodpecker runner. The push run on feature branches is redundant; the PR
pipeline is the merge gate. Run push CI only on main; PR + manual CI still
run on every branch. ~halves feature-branch CI load, zero loss of gating
(branch protection requires no push/ci status context).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01QDgorbfgN4Fgi1iHGkgndn

jason.woltje commented

2026-07-12 22:44:56 +00:00

VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head 5c7aaac955

Reviewed PR #721 as non-author against main at exact head 5c7aaac95527043a81b564c21eed4ac25262ac4a.

Evidence:

Exact head verified: PR ref and branch fix/ci-push-protected-only both resolve to 5c7aaac95527043a81b564c21eed4ac25262ac4a.
Scope verified: one CI config file only, .woodpecker/ci.yml; no source/runtime logic changes.
Diff reviewed: top-level Woodpecker when now runs pull_request and manual events on any branch, while push events are restricted to branch: main.
Claim (a) verified: the PR pipeline still runs for the feature-branch PR. Woodpecker PR pipeline #1699 exists for PR #721 on exact head 5c7aaac95527043a81b564c21eed4ac25262ac4a and is terminal success; pr-ci-wait -n 721 reports ci/woodpecker/pr/ci: success.
Claim (b) verified via Gitea API: main branch protection has enable_status_check: false and status_check_contexts: null, so no push/ci status context is required by branch protection.
git diff --check clean.
CI verified green on exact head: Woodpecker PR pipeline #1699 success for 5c7aaac95527043a81b564c21eed4ac25262ac4a.

No merge performed by reviewer.

VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head 5c7aaac95527043a81b564c21eed4ac25262ac4a Reviewed PR #721 as non-author against `main` at exact head `5c7aaac95527043a81b564c21eed4ac25262ac4a`. Evidence: - Exact head verified: PR ref and branch `fix/ci-push-protected-only` both resolve to `5c7aaac95527043a81b564c21eed4ac25262ac4a`. - Scope verified: one CI config file only, `.woodpecker/ci.yml`; no source/runtime logic changes. - Diff reviewed: top-level Woodpecker `when` now runs `pull_request` and `manual` events on any branch, while `push` events are restricted to `branch: main`. - Claim (a) verified: the PR pipeline still runs for the feature-branch PR. Woodpecker PR pipeline #1699 exists for PR #721 on exact head `5c7aaac95527043a81b564c21eed4ac25262ac4a` and is terminal `success`; `pr-ci-wait -n 721` reports `ci/woodpecker/pr/ci: success`. - Claim (b) verified via Gitea API: main branch protection has `enable_status_check: false` and `status_check_contexts: null`, so no `push/ci` status context is required by branch protection. - `git diff --check` clean. - CI verified green on exact head: Woodpecker PR pipeline #1699 success for `5c7aaac95527043a81b564c21eed4ac25262ac4a`. No merge performed by reviewer.

jason.woltje merged commit a959b1d6b4 into main

2026-07-12 22:48:59 +00:00

jason.woltje deleted branch fix/ci-push-protected-only

2026-07-12 22:49:00 +00:00

jason.woltje referenced this issue from a commit

2026-07-12 22:49:01 +00:00

ci: restrict push-event CI to protected branches (halve feature-branch load) (#721)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#721