ci: run gates on every branch, one publisher per branch

[henols]

Three commits. The first opens the triggers; the other two are fixes for things that opening them exposed.

The problem

Both firmware workflows that compile code were branch-restricted, so a push to a milestone or fix branch built nothing. AVR gates ran on main only, the ARM gate on beta only. A break surfaced at merge time rather than when it was written — and a PR targeting beta got no AVR CI at all, which is exactly what happened to #49.

Resulting shape

push beta   -> beta-build.yml (publishes pre-release) + py32f071.yml
push main   -> build.yml      (publishes stable)      + py32f071.yml
push branch -> build.yml      (gates + build, publish SKIPPED) + py32f071.yml
PR any base -> build.yml + py32f071.yml, never publishes

One publisher per branch. No path publishes twice.

99fa244 — open the triggers, make publishing explicit

Three steps in build.yml mutate the repo or publish, and their safety was implied entirely by the main-only trigger. Each now carries if: github.event_name == 'push' && github.ref == 'refs/heads/main'.

This also closes a latent duplicate-publish bug that predates this PR. On beta today, build.yml triggers on pull_request: [main] with all three steps ungated — so every PR into main would bump the version, auto-commit onto the PR branch, and cut a make_latest release. Merging then republishes the same version derived from the same include/version.h, and the second publish is rejected. Rare enough never to have bitten, but armed. PR runs can no longer publish at all.

Verified on a real run: steps 15/16/18 return skipped on a feature-branch push, while the build still runs.

branches: ['**'] rather than a bare push: — a bare trigger also fires on tag pushes, and this project pushes tags across three repos at milestone close expecting zero CI.

A concurrency group per workflow supersedes stale runs, with cancel-in-progress explicitly false on main and beta so two rapid pushes to a publishing branch queue instead of racing.

665ba99 — fetch-depth: 0, caught by the change itself

Opening the trigger made pytest tests/ -v run against beta-derived branches for the first time. It failed immediately:

FIRESTARTER_RANGE_FORK='5c9160a...' does not resolve to a commit
no commit touching 'platform/py32f071/linker/PY32F071xB_FLASH.ld' exists strictly after 40b11eb...

Not a code failure. The Phase-123/129 gates walk git history, and actions/checkout@v4 defaults to a shallow depth-1 clone. Invisible before because build.yml ran on main only, and main lags beta far enough not to carry those test files — the step passed for want of anything to run. beta-build.yml has carried fetch-depth: 0 all along.

25235c4 — keep the stable publisher off beta, backfill beta's gates

['**'] made build.yml fire on beta pushes alongside beta-build.yml. No double-publish occurred (the guards held), but it rebuilt every AVR target twice, and put the stable-release workflow on a branch that must never cut a stable release — one if: edit away from doing so. Structural exclusion beats a conditional for something that consequential: the trigger is now ['**', '!beta'].

PR coverage is untouched — pull_request has no branch filter, so a PR into beta still runs this workflow in full. Only the direct push to beta is excluded.

Removing the duplicate build would have silently removed gate coverage too, so three checks only build.yml had are backfilled into beta-build.yml:

• Vector catalog validity check
• Codegen drift gate (frame_vectors.h)
• Native unit tests (no DEV_TOOLS)

Stated plainly: before this, a beta push — the one push that produces a published artefact — was the only path not checking frame_vectors.h for codegen drift, and never compiled the no-DEV_TOOLS build.

Verification

Firestarter CI and PY32F071 firmware both pass on push and on pull_request. The publish boundary is confirmed by observed step results, not by argument:

14. Run update_version.py tests ....... success   <- fetch-depth fix
15. Generate release version .......... skipped
16. git-auto-commit-action ............ skipped
17. Build PlatformIO Project .......... success   <- deliberately outside the boundary
18. Release ........................... skipped

Merge before #49 — until this lands, #49's branch still carries pull_request: branches: [main], so the AVR gate cannot reach it and it is proven by ARM only.

🤖 Generated with Claude Code