optimize CI triggers for build/test/release workflows (#315)

.github/workflows/build.yml

@@ -1,17 +1,10 @@
 name: build
 
 on:
-  pull_request:
-    branches:
-      - main
-    paths:
-      - .github/workflows/build.yml
-      - crates/**
-      - Cargo.lock
-      - Cargo.toml
   push:
     branches:
       - main
+      - release/*
     paths:
       - .github/workflows/build.yml
       - crates/**
@@ -31,7 +24,7 @@ on:
         type: string
 
 concurrency:
-  group: build-${{ github.head_ref }}
+  group: build-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:

.github/workflows/release.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: release-${{ github.head_ref }}
+  group: release-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
@@ -22,16 +22,10 @@ jobs:
     with:
       version: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || '' }}
 
-  test:
-    uses: ./.github/workflows/test.yml
-    if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
-    with:
-      os: "macos-latest,ubuntu-latest,windows-latest"
-
   release:
     runs-on: ubuntu-latest
     if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
-    needs: [build, test]
+    needs: [build]
     environment: release
     permissions:
       attestations: write

.github/workflows/test.yml

@@ -39,7 +39,7 @@ on:
         type: string
 
 concurrency:
-  group: test-${{ github.head_ref }}
+  group: test-${{ github.ref }}
   cancel-in-progress: true
 
 env:
@@ -67,6 +67,14 @@ jobs:
           activate-environment: true
           enable-cache: true
 
+      - name: Determine OS targets
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          if [[ "$HEAD_REF" == release/* ]]; then
+            echo "OS=macos-latest,ubuntu-latest,windows-latest" >> $GITHUB_ENV
+          fi
+
       - id: set-matrix
         env:
           OS: ${{ inputs.os }}

.github/zizmor.yml

@@ -4,15 +4,15 @@ rules:
       # test workflow does not produce artifacts to poison
       - test.yml
       # all caching is disabled when a tag is pushed
-      - build.yml:96:9
+      - build.yml:87:9
+      - build.yml:97:9
       - build.yml:106:9
-      - build.yml:115:9
-      - build.yml:122:9
-      - build.yml:236:9
-      - build.yml:268:9
-      - build.yml:299:9
-      - build.yml:309:9
-      - build.yml:321:9
-      - build.yml:352:9
-      - build.yml:362:9
-      - build.yml:374:9
+      - build.yml:113:9
+      - build.yml:227:9
+      - build.yml:259:9
+      - build.yml:290:9
+      - build.yml:300:9
+      - build.yml:312:9
+      - build.yml:343:9
+      - build.yml:353:9
+      - build.yml:365:9