[marcobambini]

A pull request has never run this workflow. The only trigger was push, and a push to a fork does not run the base repository's workflow, so every pull request this project has had shows "no checks reported":

#22: no checks reported on the 'keep-stack-check-within-stack' branch
#23: no checks reported on the 'collect-garbage-after-out-of-memory' branch
#24: no checks reported on the 'end-result-sets-on-interrupt' branch

All three were merged without a single job having seen them; the 14 jobs ran on main afterwards. That is how the test #22 added reached review still failing on arm64 Linux — PTHREAD_STACK_MIN is 128 KB there, so the 64 KB thread it asks for cannot be created — which linux-arm64 and linux-musl-arm64 would have caught at once.

What changes

pull_request is now a trigger, so a pull request from a fork runs all 14 jobs.

push is limited to main. Keeping '**' alongside pull_request would run everything twice for a pull request from a branch of this repository, once per event — 28 jobs, including the macOS runners and six notarizations. To run the jobs on a branch of its own, which is useful as a dry run of a fork's pull request before merging it, the workflow_dispatch that is already here does it:

gh workflow run main.yml --ref <branch>

The signing steps are skipped where there is nothing to sign with. A pull request from a fork gets no secrets, so without this the six macOS, iOS and xcframework jobs would fail on every outside contribution, at security import or at notarytool submit. They now run the build and the tests and skip signing, which is what the pull request is for. Those artifacts are unsigned, and release runs only for main (if: github.ref == 'refs/heads/main'), so an unsigned artifact is never released. A secret can be read in a job's env but not in a step's if, hence SIGNING as an env entry rather than a condition on secrets directly.

How it was checked

This branch cannot run its own new trigger: GitHub reads the workflow of the base branch for a pull_request event, and main has no such trigger yet. So this pull request shows no checks either — the last one that will.

Checked instead by:

• pushing the branch, which started nothing, confirming push is limited to main;
• a workflow_dispatch run on the branch, which uses this file and runs all 14 jobs: run 43424592133;
• parsing the file to confirm the triggers, the 14 matrix entries, the four guarded steps and the release condition.

Worth doing right after merging: open a throwaway pull request from a branch here and check that exactly one run appears, from the pull_request event and not two.

🤖 Generated with Claude Code