[codex] Restrict GitHub Actions triggers

.github/workflows/blog-3day-report.yml

@@ -40,7 +40,7 @@ concurrency:
 jobs:
   report:
     name: Daily 3-day traffic digest
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     timeout-minutes: 10
 

.github/workflows/blog-indexing-monitor.yml

@@ -38,7 +38,7 @@ concurrency:
 jobs:
   monitor:
     name: Monitor recent blog URLs
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     timeout-minutes: 15
 

.github/workflows/blog-indexing-on-deploy.yml

@@ -39,6 +39,8 @@ jobs:
   index:
     name: Index newly deployed blog posts
     if: >-
+      (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name))
+      &&
       github.repository == 'nexu-io/open-design'
       && (
         github.event_name == 'workflow_dispatch'

.github/workflows/ci.yml

@@ -28,6 +28,7 @@ concurrency:
 
 jobs:
   change_scopes:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     name: Detect CI change scopes
     runs-on: ubuntu-latest
     outputs:

.github/workflows/contributor-card-bot.yml

@@ -12,6 +12,10 @@ name: Contributor Card Bot
 # want to recognize. They can be re-added later via a workflow_run handoff.
 on:
   pull_request_target:
+    branches:
+      - development
+      - test
+      - main
     types: [closed]
   issues:
     types: [opened]
@@ -40,6 +44,7 @@ jobs:
   recognize:
     name: Render and post contributor card
     if: |
+      (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) &&
       github.repository == 'nexu-io/open-design' &&
       (
         (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true) ||

.github/workflows/critique-conformance.yml

@@ -24,6 +24,7 @@ on:
 
 jobs:
   run:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     name: nightly conformance + ratchet snapshot
     runs-on: ubuntu-latest
     timeout-minutes: 30

.github/workflows/docker-image.yml

@@ -2,15 +2,14 @@ name: Docker image
 
 # Phase 5 / spec §15.5 — multi-arch image builds.
 #
-# Pushes to ghcr.io on:
-#   - tag (v*.*.*)    → ghcr.io/<owner>/od:<tag> + :latest
+# Pushes to ghcr.io when run manually for a selected ref.
 
 on:
-  push:
-    tags: ['v*.*.*']
+  workflow_dispatch:
 
 jobs:
   build-and-push:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/landing-page-ci.yml

@@ -2,6 +2,10 @@ name: landing-page-ci
 
 on:
   pull_request:
+    branches:
+      - development
+      - test
+      - main
     paths:
       # Workflow files
       - .github/workflows/landing-page-ci.yml
@@ -48,6 +52,7 @@ concurrency:
 
 jobs:
   validate:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     name: Validate landing page
     runs-on: ubuntu-latest
     timeout-minutes: 20

.github/workflows/landing-page-deploy.yml

@@ -35,7 +35,7 @@ concurrency:
 jobs:
   deploy:
     name: Deploy landing page
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     timeout-minutes: 20
 

.github/workflows/metrics.yml

@@ -17,7 +17,7 @@ permissions:
 jobs:
   metrics:
     name: Generate repository metrics SVG
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     steps:
       - name: Generate Open Design bot token

.github/workflows/nix-check.yml

@@ -31,6 +31,7 @@ permissions:
 
 jobs:
   build:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/pr-author-inactivity.yml

@@ -45,7 +45,7 @@ concurrency:
 
 jobs:
   triage:
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     steps:
       - name: Remind or close inactive PRs

.github/workflows/refresh-contributors-wall.yml

@@ -20,7 +20,7 @@ concurrency:
 jobs:
   refresh:
     name: Refresh contributors wall cache bust
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/release-beta.yml

@@ -45,7 +45,7 @@ env:
 jobs:
   metadata:
     name: Prepare beta metadata
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     env:
       OPEN_DESIGN_BETA_METADATA_URL: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}/beta/latest/metadata.json

.github/workflows/release-preview.yml

@@ -22,6 +22,7 @@ env:
 
 jobs:
   metadata:
+    if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)
     name: Prepare preview metadata
     runs-on: ubuntu-latest
     env:

.github/workflows/release-stable.yml

@@ -36,7 +36,7 @@ env:
 jobs:
   metadata:
     name: Prepare release metadata
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     env:
       GH_TOKEN: ${{ github.token }}

.github/workflows/seo-daily-report.yml

@@ -28,7 +28,7 @@ concurrency:
 jobs:
   report:
     name: Post SEO daily report to Feishu
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     timeout-minutes: 10
 

.github/workflows/stale-issues.yml

@@ -30,7 +30,7 @@ concurrency:
 
 jobs:
   stale:
-    if: github.repository == 'nexu-io/open-design'
+    if: (github.event_name != 'workflow_dispatch' || contains(fromJSON('["development","test","main"]'), github.ref_name)) && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-latest
     steps:
       - name: Exempt org-member issues from staling