perf(ci): one Code Quality run per commit, not two

[rubenvdlinde]

A push to a branch with an open PR ran the same 34 jobs twice on the same
commit. concurrency cannot deduplicate them: the group is suffixed by event
name deliberately (ConductionNL/.github#540 — a default-branch push carries
jobs a PR run does not, and a workflow_dispatch must not be cancellable by
the standing release PR), so push and pull_request sit in different lanes
by design and both run to completion.

Measured, fleet-wide, 2026-08-25 → 27

Code Quality runs	2,106
...that were a push duplicating a PR run on the same commit	659 (31%)
Feature-branch push runs with no PR run beside them	9 of 668
Concurrent job ceiling (GitHub Team plan)	60
Measured at one instant	53 running, 1,528 queued
Oldest run not yet started	425 minutes
Median successful run	78.5 min — of which ~38 job-min is work
Median wait per job before it starts	28.6 min (100% of jobs waited >10 min)

The suite is not slow. Its longest job is 16 minutes. ~96% of the wall clock is
queueing, and duplicate runs are the single largest contributor.

What changes

on.push.branches keeps only the default branches this repo already listed and
drops the feature-branch globs. pull_request is untouched and still covers
every one of those branches on [opened, reopened, synchronize], so every
commit going anywhere is still fully checked — once.

No branch loses its floor

merge-hygiene.yml runs on '**' — every branch anyone pushes, no prefix list
to forget — and it is the check development actually requires. That is the
smoke alarm; Code Quality is the fire brigade and belongs on the PR.

The default branches stay: their push runs are not duplicates, they are the only
carrier of Coverage Baseline Check, SBOM and Features Extract, none of which run
on a pull_request event.

Verification

Both versions of every one of the 21 files were parsed with PyYAML and compared
key by key: name, concurrency, permissions, jobs and on.pull_request
are identical, and the new push.branches is a strict subset of the old. The
only structural change is the removal of the glob entries.

[github-actions]

Quality Report — ConductionNL/stackiq @ cdb0073

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 130/130
npm			✅	✅ 721/721
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-27 19:36 UTC

Download the full PDF report from the workflow artifacts.