[austenstone]

What

Drop the push: branches-ignore: [main] trigger from ci.yml. pull_request (the required ci check) and workflow_dispatch stay.

Why

Every commit on a PR branch ran CI twice: once for push, once for pull_request. The concurrency group is ci-${{ github.ref }}, and those refs differ (refs/heads/x vs refs/pull/N/merge), so neither run cancelled the other. Same SHA, same steps, same result, double the minutes.

Baseline (last 90 days, 2026-07-13 → 2026-10-11, all CI + Deploy jobs via jobs API)

	Runs	Rounded job min	p50 job	p50 job wait
CI pull_request	21	32	61s	2s
CI push	30	42	59.5s	2s
Deploy (build + deploy)	9	20	50s / 11s	2–4s
Total		94

• 21 of 30 CI-tested SHAs ran CI on both events. Those 21 duplicate push runs = 28 rounded min (30% of all repo Actions minutes, 38% of CI minutes).
• Queue is not a factor (p50 wait 2s). Execution is ~60s, dominated by test:coverage (~30s); coverage thresholds are enforced so it stays.
• Considered and rejected: removing the separate typecheck step. Both tsconfigs are noEmit, so build's tsc -b is an incremental no-op after typecheck; removing it only shifts the time.

Expected after

1 CI run per PR commit instead of 2. Projected on the same window: 51 → 30 CI runs, 74 → 46 rounded CI min (−38%).

Trade-off: a branch pushed before a PR exists no longer gets automatic CI. Run it via Actions → CI → Run workflow if needed. main is still validated by the Deploy workflow on push.

Verification

• actionlint clean before/after. zizmor findings unchanged (pre-existing pinning findings, out of scope).
• Required check ci (ruleset on main) is produced by the pull_request run, unchanged.
• Canary: this PR. The push of this branch should produce zero CI runs; the PR should produce exactly one.

Note: this repo is public, so billed cost is $0 either way. Rounded minutes are the cost-equivalent for a private repo on standard runners.