ci: avoid duplicate feature branch push runs

[cpunion]

Feature branches in forks currently run the full CI suite twice when they have an open upstream PR: once for the fork push event and again for the upstream pull_request event.

Direct evidence from PR #2036, commit 8fc1aa05c8:

• fork push runs: 8 workflows / 38 jobs, started at 2026-07-29 20:08:01 UTC
• upstream PR runs: the same 8 workflows / 38 jobs for the same SHA, started 3-4 seconds later
• the same duplication occurred on multiple earlier updates of that PR, including 6710edbf18 and 7b1cfbc1ba

Doc Link Checker was not included in that count because those commits did not change README.md; it can be a ninth duplicated workflow when its path filter matches.

This PR narrows feature-branch push triggers while preserving the existing tag behavior:

• eight regular CI workflows run on push only for main
• release-build.yml runs on push for main and tags
• all nine workflows continue to run for every pull_request branch
• existing path filters, schedules, and manual triggers remain unchanged

After pushing this branch, the fork produced no feature-branch push runs, confirming the narrowed trigger works. The upstream PR continues to receive the complete pull_request CI suite.

Validation:

• parsed all workflow YAML files
• asserted main-only push for the eight regular workflows and main+tags for release-build.yml
• asserted pull_request.branches: ["**"] for all nine changed workflows
• git diff --check

[fennoai]

Review: ci: avoid duplicate feature branch push runs

The branch-narrowing half of this change is correct and achieves the stated goal: restricting push.branches to main means feature-branch pushes are no longer double-run (they're now covered only by pull_request).

However, the same diff also adds tags: ["*"] to all 9 workflows, and this introduces a new class of redundant runs that works against the PR's own goal.

Main issue — heavy CI now runs on every tag push (high confidence)

Previously the branches: ["**", "!dependabot/**", "!xgopilot/**"] filter matched branch pushes only and never fired on tags. Only release-build.yml legitimately consumes tags (its release job is gated by if: startsWith(github.ref, 'refs/tags/')). The other 8 workflows have no tag-specific logic, so adding tags: ["*"] means:

• Release tags in this repo are pushed on top of a commit already on main. That commit already ran full CI on the main push; the tag push now re-runs the identical matrices a second time over the same tree.
• The two heaviest workflows (go.yml, llgo.yml — 60-minute matrices, WAMR-from-source, coverage, etc.) are the ones re-run.
• The concurrency groups are keyed on github.event.pull_request.number || github.ref, and refs/tags/<tag> ≠ refs/heads/main, so these runs are not deduped/cancelled against the main push — they run concurrently.
• "*" matches any single-segment tag, not just release tags (v*), so even ad-hoc/non-release tags will spin up the full matrices.

Recommendation: Keep tags: ["*"] only on release-build.yml. Drop the added tags: block from the other 8 workflows and keep just branches: [main] under push. (If some of them genuinely need to run at release time, prefer tags: ["v*"] and/or a per-job refs/tags/ gate rather than running the whole matrix on every tag.)

Minor, supporting:

• .github/workflows/go.yml uploads coverage using secrets.CODECOV_TOKEN (lines 102, 206). With the new tag trigger, this will now push coverage to Codecov on every tag push as well — another consequence of the blanket tags addition.
• .github/workflows/doc-link-checker.yml already restricts to paths: ["README.md"] and runs on a daily schedule; a tags trigger for a link checker is almost certainly unintended.

No security-scanning coverage is lost (there is no CodeQL/security workflow among the changed files), fork-PR secret exposure is unchanged (all use pull_request, not pull_request_target), and no documentation references the old branch-filter behavior.

Inline comments are on the representative/heaviest files; the same tags: addition applies to build-cache.yml, doc.yml, fmt.yml, stdlib-coverage.yml, and targets.yml as well.

View job run

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!