ci: run nine workflows once per PR commit, on every path their push run watched

.github/workflows/conformance-frame-alignment.yml

@@ -2,6 +2,7 @@ name: Conformance frame alignment
 on:
   workflow_dispatch:
   push:
+    branches: [main]
     paths:
       - 'conformance/**'
       - 'fpga/vivado/**'
@@ -11,11 +12,13 @@ on:
       - 'conformance/frame_alignment_check.py'
       - 'conformance/gfternary_compute_conformance_ax7203.py'
       - 'conformance/trinet_mac32_conformance_ax7203.py'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'conformance/**'
       - 'fpga/vivado/**'
       - 'fpga/openxc7-synth/**'
+      - '.github/workflows/conformance-frame-alignment.yml'
   schedule:
     # Daily, so a wrapper edit that silently orphans a host surfaces within a
     # day rather than at the next flash session.

.github/workflows/conformance-selftest.yml

@@ -17,9 +17,11 @@ on:
       - 'conformance/compute_golden_consistency.py'
       - 'conformance/corona_decode_host_ax7203.py'
       - 'conformance/golden_consistency.py'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'conformance/**'
+      - '.github/workflows/conformance-selftest.yml'
 
 jobs:
   selftest:

.github/workflows/fpga-regression.yml

@@ -19,12 +19,15 @@ on:
       - 'src/tri/tri_sacred_fpga.zig'
       - 'fpga/openxc7-synth/**'
       - '.github/workflows/fpga-regression.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     branches: [main]
     paths:
       - 'specs/fpga/**'
       - 'src/tri/tri_fpga.zig'
+      - 'src/tri/tri_sacred_fpga.zig'
       - 'fpga/openxc7-synth/**'
+      - '.github/workflows/fpga-regression.yml'
   workflow_dispatch:
 
 env:

.github/workflows/gates-can-fail.yml

@@ -38,6 +38,7 @@ name: Gates can fail
 
 on:
   push:
+    branches: [main]
     paths:
       - 'tools/check_*.py'
       - 'tools/materialise_siblings.sh'

.github/workflows/gf-adder-ref-tb.yml

@@ -15,12 +15,14 @@ on:
       - 'formal/gf_adder_ref_tb.v'
       - 'formal/gf_mul_ref_tb.v'
       - '.github/workflows/gf-adder-ref-tb.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'fpga/openxc7-synth/gf_adder_param.v'
       - 'fpga/openxc7-synth/gf_mul_param.v'
       - 'formal/gf_adder_ref_tb.v'
       - 'formal/gf_mul_ref_tb.v'
+      - '.github/workflows/gf-adder-ref-tb.yml'
 
 jobs:
   ref-tb:

.github/workflows/reachability-ratchet.yml

@@ -26,14 +26,17 @@ name: reachability ratchet
 
 on:
   push:
+    branches: [main]
     paths:
       - 'src/tri/**'
       - 'build.zig'
       - '.github/workflows/reachability-ratchet.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'src/tri/**'
       - 'build.zig'
+      - '.github/workflows/reachability-ratchet.yml'
   workflow_dispatch:
 
 # GitHub's default step shell is `bash -e {0}` -- NO pipefail. In `measurer | tee

.github/workflows/rtl-check.yml

@@ -6,17 +6,21 @@ name: RTL check
 # resolving the ref, reading the inputs across the boundary, checking out the
 # CALLER's code rather than the callee's.
 #
-# It also means these two chips are checked on every push by the same thing that
-# is offered to strangers, which is the only honest way to offer it.
+# It also means these two chips are checked on every PR commit and every push to
+# main by the same thing that is offered to strangers, which is the only honest
+# way to offer it.
 
 on:
   push:
+    branches: [main]
     paths:
       - 'ttsky26c/**'
       - '.github/workflows/rtl-check.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'ttsky26c/**'
+      - '.github/workflows/rtl-check.yml'
   workflow_dispatch:
 
 permissions:

.github/workflows/tri-build.yml

@@ -28,18 +28,21 @@ name: tri builds
 
 on:
   push:
+    branches: [main]
     paths:
       - 'build.zig'
       - 'build.zig.zon'
       - 'src/tri/**'
       - 'src/vsa**'
       - '.github/workflows/tri-build.yml'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'build.zig'
       - 'build.zig.zon'
       - 'src/tri/**'
       - 'src/vsa**'
+      - '.github/workflows/tri-build.yml'
   workflow_dispatch:
 
 env:

.github/workflows/trinet-portability.yml

@@ -14,6 +14,7 @@ name: TRI-NET portability and receipt keys
 on:
   workflow_dispatch:
   push:
+    branches: [main]
     paths:
       - 'fpga/portable/**'
       - 'fpga/vivado/trinet_node_v2_ax7203.v'
@@ -23,13 +24,16 @@ on:
       - '.github/workflows/trinet-portability.yml'
       # the scripts this job runs: fixing a check must re-run it
       - 'conformance/portability_check.py'
+  # every push path, so a PR that touches only one of them still runs this
   pull_request:
     paths:
       - 'fpga/portable/**'
       - 'fpga/vivado/trinet_node_v2_ax7203.v'
       - 'fpga/openxc7-synth/trinet_siphash24.v'
       - 'formal/trinet_node_v2_tb.v'
       - 'conformance/key_default_check.py'
+      - '.github/workflows/trinet-portability.yml'
+      - 'conformance/portability_check.py'
   schedule:
     - cron: '41 5 * * *'