From 6001d44b064f51784ce8f66a11b2b5598f54a7e9 Mon Sep 17 00:00:00 2001
From: Manuel de Brito Fontes <aledbf@gmail.com>
Date: Tue, 8 Sep 2026 00:40:41 -0300
Subject: [PATCH] CI runs once, and no workflow cancels a commit on main
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two changes, matching what storage now does and what three of the four workflows
here already did.

**ci.yml fired twice per push.** An unfiltered `push:` fires alongside
`pull_request:` for every push to a branch with one open, so every push started
two identical runs and the concurrency group killed one — after both had taken a
runner. image.yml, kernel.yml and qemu.yml have always filtered `push:` to main;
this was the exception.

**Nothing cancels a run on main any more.** cancel-in-progress applied there too,
so two merges landing close together left the first with no verdict. Two merges
are two things to verify.

What is given up: a branch with no pull request open is not tested. That is what
opening one is for.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019GHRRFvbnZi5q3KSTvyW5a
---
 .github/workflows/ci.yml     | 18 +++++++++++++-----
 .github/workflows/image.yml  |  3 ++-
 .github/workflows/kernel.yml |  3 ++-
 .github/workflows/qemu.yml   |  3 ++-
 4 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 99352ac..c57e3d5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,17 +6,25 @@ name: CI
 # here is fast and is the half that catches most mistakes — the machine definition, and
 # whether the scripts and Taskfiles parse at all.
 
+# A branch is tested through its pull request, and main when something lands on it. Not
+# both: an unfiltered `push:` fires alongside `pull_request:` for every push to a branch
+# that has one open, so every push started two identical runs and the concurrency group
+# below killed one of them. That worked and cost a run each time — both started, both took
+# a runner — and left a column of `cancelled` in the run list that reads like a fault.
+#
+# It is also what the other three workflows here have always done; this one was the
+# exception.
 on:
   push:
+    branches: [main]
   pull_request:
 
-# One run per branch, not one per event. A push to a branch with an open pull request fires
-# both triggers; keying on `head_ref || ref_name` gives both the same string, while
-# `github.ref` — the obvious choice — does not (`refs/pull/N/merge` against
-# `refs/heads/my-branch`, two groups, nothing de-duplicated).
+# A new push to a branch supersedes the run its predecessor started, because only the tip
+# is worth a verdict. Never on main: a cancelled run there is a commit nobody proved, and
+# two merges landing close together are two things to verify.
 concurrency:
   group: ci-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
 
 permissions:
   contents: read
diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index a1a75bc..b0089f4 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -27,7 +27,8 @@ permissions:
 
 concurrency:
   group: image-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
+  # Never on main: a cancelled run there is a commit nobody proved.
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
 
 jobs:
   build:
diff --git a/.github/workflows/kernel.yml b/.github/workflows/kernel.yml
index 0c65c04..aeeb148 100644
--- a/.github/workflows/kernel.yml
+++ b/.github/workflows/kernel.yml
@@ -27,7 +27,8 @@ permissions:
 
 concurrency:
   group: kernel-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
+  # Never on main: a cancelled run there is a commit nobody proved.
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
 
 jobs:
   build:
diff --git a/.github/workflows/qemu.yml b/.github/workflows/qemu.yml
index 7ba4c0d..8723fc0 100644
--- a/.github/workflows/qemu.yml
+++ b/.github/workflows/qemu.yml
@@ -29,7 +29,8 @@ permissions:
 
 concurrency:
   group: qemu-${{ github.head_ref || github.ref_name }}
-  cancel-in-progress: true
+  # Never on main: a cancelled run there is a commit nobody proved.
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
 
 jobs:
   build: