ci: do not run cd when a branch is created

[radu-mocanu]

CD triggers on pushes to main and release/** filtered to pyproject.toml. Creating a release/* branch at a commit that touched pyproject.toml is a push that can match that filter, so the branch creation itself starts a publish run for a version that was already released.

Today PyPI rejects the duplicate upload, so the run just goes red. It is not harmless in every case: if the base commit's version bump was never actually published, branch creation would publish it from a branch nobody treated as a release. The pypi environment has no protection rules or deployment branch policy, so there is no second gate.

Gate the CD entry job on !github.event.created. build needs lint and pypi-publish needs build, so skipping lint skips the chain. Manual workflow_dispatch runs are unaffected, since the property is absent there and evaluates as falsy.

Merging a hotfix PR into a release branch is a normal push with commits, so created is false and the publish still runs as intended.

[Copilot]

🟢 Approval recommended

The change is minimal, syntactically correct for job-level gating, and effectively prevents unintended publishes on branch creation while preserving normal pushes and manual runs.

Pull request overview

This PR prevents the CD workflow from publishing when a release/** branch is created (i.e., the first push that creates the remote ref), which can otherwise accidentally trigger a publish for an already-released version (or worse, publish a version bump from a branch that wasn’t intentionally treated as a release).

Changes:

• Add a job-level gate to skip the CD pipeline when the push event indicates the ref was newly created (github.event.created == true).
• Rely on the existing needs chain (build needs lint, pypi-publish needs build) so skipping lint skips the entire publish flow.
• Keep workflow_dispatch behavior unchanged (missing created evaluates falsy, so the condition passes).

File summaries

File	Description
.github/workflows/cd.yml	Adds an if: ${{ !github.event.created }} gate to prevent CD from running on branch-creation pushes.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud