From 3eba22cd175a3fca64f15e02615f0c68158c0176 Mon Sep 17 00:00:00 2001
From: Daniele Barbaro <barbaro.daniele@gmail.com>
Date: Tue, 8 Sep 2026 15:15:24 +0200
Subject: [PATCH] ci: run tests and phpstan on pull requests

Both workflows only triggered on push, so a pull request from a fork ran
no tests and no static analysis at all: the checks appeared on the
branch after a merge, which is the wrong side of the decision. That
matters more than usual here because dependabot-auto-merge.yml runs on
pull_request_target and calls `gh pr merge --auto` for every semver
minor and patch bump, so dependency updates could reach main without a
single test having run against them.

Push is now scoped to main, so a branch that has a pull request open
gets one run rather than two.
---
 .github/workflows/phpstan.yml   | 7 +++++++
 .github/workflows/run-tests.yml | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index 7395a1a..59283c3 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -2,6 +2,13 @@ name: PHPStan
 
 on:
   push:
+    branches:
+      - main
+    paths:
+      - '**.php'
+      - 'phpstan.neon.dist'
+      - '.github/workflows/phpstan.yml'
+  pull_request:
     paths:
       - '**.php'
       - 'phpstan.neon.dist'
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 481cfce..5c74e8c 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -2,6 +2,15 @@ name: run-tests
 
 on:
   push:
+    branches:
+      - main
+    paths:
+      - '**.php'
+      - '.github/workflows/run-tests.yml'
+      - 'phpunit.xml.dist'
+      - 'composer.json'
+      - 'composer.lock'
+  pull_request:
     paths:
       - '**.php'
       - '.github/workflows/run-tests.yml'