From 70b89e7cfe55f64965ae0f0a2ee822877894de0d Mon Sep 17 00:00:00 2001
From: Erick Ti <63139298+erick-ti@users.noreply.github.com>
Date: Wed, 8 Jul 2026 23:06:17 -0700
Subject: [PATCH 1/2] scope gitleaks push trigger to main

An unscoped push trigger ran gitleaks twice on every pull request, once
for the push to the PR branch and once for the pull_request event. Scope
push to main so PR branches get exactly one run.

Pre-merge coverage is unchanged. The required check "scan for secrets" is
produced by the pull_request run, and main is still scanned on every push
after a merge.
---
 .github/workflows/gitleaks.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index 65807d9..e570e8f 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -1,7 +1,10 @@
 name: gitleaks
 
+# push only on main: PR branches are already covered by the pull_request
+# run, and an unscoped push trigger fired a duplicate run on every PR.
 on:
   push:
+    branches: [main]
   pull_request:
   workflow_dispatch:  # allow manual runs from the Actions tab
 

From 24a27703de37fec8fb68c1e74a203e01fcf34754 Mon Sep 17 00:00:00 2001
From: Erick Ti <63139298+erick-ti@users.noreply.github.com>
Date: Wed, 8 Jul 2026 23:37:54 -0700
Subject: [PATCH 2/2] scope tests and web push triggers to main

Mirrors the gitleaks change. Both ran twice on every pull request, once
for the push to the PR branch and once for the pull_request event. Scope
push to main so each runs once per PR.

The required contexts all report from the pull_request run, so merges are
unaffected. A branches filter with no tags key means tag pushes no longer
trigger these workflows, and neither one builds or publishes anything.
---
 .github/workflows/tests.yml | 3 +++
 .github/workflows/web.yml   | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 6dafb5f..0c8bcc9 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,7 +1,10 @@
 name: tests
 
+# push only on main: PR branches are already covered by the pull_request
+# run, and an unscoped push trigger fired a duplicate run on every PR.
 on:
   push:
+    branches: [main]
   pull_request:
   workflow_dispatch:  # allow manual runs from the Actions tab
 
diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index ea06c73..4cb6caf 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -1,7 +1,10 @@
 name: web
 
+# push only on main: PR branches are already covered by the pull_request
+# run, and an unscoped push trigger fired a duplicate run on every PR.
 on:
   push:
+    branches: [main]
   pull_request:
   workflow_dispatch:  # allow manual runs from the Actions tab