Restrict push trigger to master to avoid duplicate PR-branch runs

Co-authored-by: Kanti <471387+Kanti@users.noreply.github.com>

Author: Copilot

.github/workflows/build.yaml

@@ -3,7 +3,9 @@ name: build
   schedule:
     -
       cron: '0 0 * * *'
-  push: null
+  push:
+    branches:
+      - master
   pull_request:
     branches:
       - master

ci/src/Commands/GithubCommand.php

@@ -59,7 +59,18 @@ protected function execute(InputInterface $input, OutputInterface $output)
                 'schedule' => [
                     ['cron' => '0 0 * * *'], // every week on Tuesday
                 ],
-                'push' => null,
+                // Restricted to 'master' so a PR branch's commits are only
+                // ever built once, via the 'pull_request' event below. A
+                // broad `push: null` trigger (any branch) would otherwise
+                // fire a second, fully duplicate run of the whole pipeline
+                // (build, test, and the OCI artifact dance) for the exact
+                // same commit as its corresponding pull_request run. Master
+                // itself is never reached by 'pull_request' (it has no PR
+                // targeting itself), so its push-triggered publish path is
+                // unaffected.
+                'push' => [
+                    'branches' => ['master'],
+                ],
                 'pull_request' => [
                     'branches' => ['master'],
                 ],