From b0d2cc24aa8f1c2e92b410f671c67169230a0d44 Mon Sep 17 00:00:00 2001
From: Val Neekman <val@neekware.com>
Date: Tue, 22 Sep 2026 16:53:35 -0400
Subject: [PATCH] CI: run only on pull requests into main; drop tag publish

Test and build before merge only. main is protected (PR-only, checks
required), so post-merge and tag runs re-did work already verified.
Releases are published manually.
---
 .github/workflows/ci.yml | 34 ++++------------------------------
 1 file changed, 4 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8e6baa3..4d997dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,19 +1,13 @@
 name: ci
 
+# Runs only on pull requests into main: test and build before merge.
+# main is protected (PR-only, these checks required), so nothing reaches it
+# untested and there is no need to re-run after merge. Releases are
+# published manually; tags do not trigger CI.
 on:
-  push:
-    branches:
-      - ci
-      - dev
-      - main
-    tags:
-      - "v*"
   pull_request:
     branches:
-      - ci
-      - dev
       - main
-  workflow_dispatch:
 
 jobs:
   ci:
@@ -89,23 +83,3 @@ jobs:
           path: dist/*
           if-no-files-found: error
           retention-days: 7
-
-  pypi-publish:
-    name: Publish
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v')
-    permissions:
-      id-token: write # mandatory for trusted publishing
-    needs:
-      - build
-      - ci
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          name: artifacts
-          path: dist
-      - name: Publish build to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          # A version already on PyPI (e.g. uploaded manually) is not an error.
-          skip-existing: true