.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-# Runs the checks on every push and pull request.
+# Runs the checks on pull requests and on main.
 #
 # release.yml already runs `go vet` and `go test`, but only once a vX.Y.Z tag exists — by then
 # a red change is on the release path and the only remedy is a new tag. This is the same gate
@@ -6,14 +6,17 @@
 # the release goes through the Dockerfile, and the Dockerfile runs `npm run build`, never
 # `npm test`.
 #
-# Tags are excluded from the push trigger. A vX.Y.Z push fires release.yml, which repeats the
-# Go job itself; running both would spend a private repository's Actions minutes twice for one
-# answer.
+# The push trigger is limited to main rather than every branch, for the reason release.yml is
+# not repeated here: a branch with an open PR would otherwise run the whole suite twice per
+# push, once for refs/heads/<branch> and once for refs/pull/N/merge. Those are different
+# concurrency groups, so neither cancels the other, and this repository is private and billed
+# for both. A branch with no PR open yet is the one case that loses coverage, and opening the
+# PR is what asks for the answer.
 name: ci
 
 on:
   push:
-    branches: ['**']
+    branches: [main]
   pull_request:
 
 permissions: