From d21c944f3f04b3da1683fdcd7053a75973fe0138 Mon Sep 17 00:00:00 2001
From: jwinterm <johnwmurphy@gmail.com>
Date: Tue, 19 May 2026 07:57:22 -0400
Subject: [PATCH] CI: manual-trigger only for all build workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Auto-triggers on push were noisy — every merged PR kicked off the
linux + android + ios-sim builds. Switching to workflow_dispatch only.
Trigger via Gitea Actions UI when you want a build. workflow_dispatch
runs as the authenticated user, so secrets are always present.

Adds the push trigger back when we want pre-merge gating or CI on every
commit (e.g., release-tag automation).
---
 .github/workflows/build-android.yml | 10 +++-------
 .github/workflows/build-ios-sim.yml |  5 ++---
 .github/workflows/build-linux.yml   |  9 +++------
 3 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index b682b6890..a1e566107 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -5,13 +5,9 @@ name: Hash Bags Android build
 # - PRs targeting dev/main (gate merges)
 # - manual via workflow_dispatch
 on:
-  # PR-from-fork triggers strip secrets in Gitea (and GitHub) for security.
-  # We mirror github-such-software/hash-wallet → Builds/hash-wallet via PRs,
-  # so a pull_request trigger here would always run without secrets.
-  # Listen only to push events on the destination branch (post-merge) so
-  # secrets are reliably available.
-  push:
-    branches: [dev, main]
+  # Manual-only for now. Trigger via Actions → "Hash Bags Android build"
+  # → Run workflow when you want a build. workflow_dispatch runs as the
+  # triggering user, so secrets are always available (unlike PR triggers).
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/build-ios-sim.yml b/.github/workflows/build-ios-sim.yml
index 6be9bafe6..f5a934be9 100644
--- a/.github/workflows/build-ios-sim.yml
+++ b/.github/workflows/build-ios-sim.yml
@@ -8,9 +8,8 @@ name: Hash Bags iOS Simulator build
 # Phase 2 (separate workflow): full TestFlight pipeline with signing.
 
 on:
-  # See note in build-android.yml about Gitea PR-from-fork secret stripping.
-  push:
-    branches: [dev, main]
+  # Manual-only for now. Trigger via Actions → "Hash Bags iOS Simulator
+  # build" → Run workflow when you want a build.
   workflow_dispatch:
 
 # Cancel in-flight runs when a newer commit lands on the same branch — so a
diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index e8422c0ef..332824cd8 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -5,12 +5,9 @@ name: Hash Bags Linux build
 # - on PRs targeting dev/main (gates merges)
 # - manual via workflow_dispatch ("Run workflow" button in the UI)
 on:
-  # See note in build-android.yml about pull_request vs push triggers and
-  # Gitea Actions' from-fork secret stripping. Push-only here too for
-  # consistency (no secrets are required for Linux build today, but if we
-  # add any in future this avoids surprises).
-  push:
-    branches: [dev, main]
+  # Manual-only for now — auto-run on every push was too noisy. Trigger
+  # via Actions → "Hash Bags Linux build" → Run workflow when you want a
+  # build. Add `push:` back here if/when we want pre-merge validation.
   workflow_dispatch:
 
 concurrency: