From 995cf83ab86bb7a675de6a088ac82923e78aeb03 Mon Sep 17 00:00:00 2001
From: David Sherret <dsherret@gmail.com>
Date: Mon, 13 Jul 2026 12:26:20 -0400
Subject: [PATCH 1/2] ci: don't run push workflow for PR branches

---
 .github/workflows/ci.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f8f39e3..ba4531f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,10 @@
 name: ci
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+    tags: ['*']
+  pull_request:
 
 concurrency:
   group: '${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}'

From 20ff7975d61380792d41360f2476c26d96214288 Mon Sep 17 00:00:00 2001
From: David Sherret <dsherret@gmail.com>
Date: Mon, 13 Jul 2026 12:27:13 -0400
Subject: [PATCH 2/2] ci: drop unneeded id-token permission from test job

---
 .github/workflows/ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba4531f..d434da1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
-      id-token: write
     timeout-minutes: 30
     strategy:
       matrix: