A branch with no PR can still be checked, and path filters are a no we wrote down

[JulienMartel]

What

Two leftovers from the CI pass that #578 landed.

• .github/workflows/test.yml gets workflow_dispatch:.
• docs/ci.md rule 2's canonical trigger block gets the same line, plus a
  sentence saying what it is for.
• docs/ci.md's What we deliberately don't do gains a paths-ignore
  stanza, with the measurement and the method.
• The same section's "no hosted binary cache" now says what it does not rule
  out.

hausfold/factory#23 is this PR's other half: the same one line, in the one
other repo that had the gap. It is green.

Why

The dispatch line. Narrowing push to branches: [main] stops a commit on
a PR branch being checked twice. It also takes away the only way a branch with
no PR yet was ever checked — and #578 wrote the narrowed trigger into
docs/ci.md as the family standard without the line that hands that back.
haus's check.yml has had workflow_dispatch all along, with a comment
explaining exactly this. Now the rule, workshop and factory all match haus.

The path filter. It was an open question in this project and it now has a
measured answer: no. Against a real ignore list over each repo's last 40 merged
PRs, the share that would actually skip is

repo	would skip
haus	1 / 40
trill	6 / 40
scruff	10 / 40
perch	11 / 40
nebelung	12 / 40

A quarter at the top of the range, one in forty at the bottom, saving two or
three minutes each. That does not buy a second silent copy of "which files does
this job protect?" — the copy rots, which is docs/drift.md's whole subject —
and prose in this family is guarded prose (embed-skills.sh --check, the two
check-skills.sh, the generated issue forms). The sharp end is scruff:
release.yml reaches its gate through workflow_call, so a filter that skips a
job on a docs path skips it for a tag too, publishing to registries that have no
undo.

The stanza carries the method as well as the number, because the loose version
of this measurement is how the idea keeps coming back: a classifier that counts
modules/**/*.md and dist/**/README.md as docs says 80%, which for haus is
wrong by a factor of thirty.

The substituter carve-out. "No hosted binary cache" reads as a blanket no,
and its three reasons (an account, a token in nine repos, a service that can be
down) are all about a cache we run. A public read-only extra-substituters
entry for something nixpkgs doesn't carry has none of them and fails soft to
building from source. Saying so keeps the next person from reading the stanza as
a blocker.

Verify

git show HEAD:.github/workflows/test.yml \
  | ruby -ryaml -e 'p YAML.safe_load($stdin.read)[true]'
# => {"push"=>{"branches"=>["main"]}, "pull_request"=>nil, "workflow_dispatch"=>nil}

The block in docs/ci.md rule 2 is now byte-identical to that trigger. After
merge, Actions → Tests → Run workflow offers a branch picker, and a PR here
still produces one run per commit.

Re-run the measurement (about a minute):

gh pr list --repo hausfold/perch --state merged --limit 40 --json number,files

then count the PRs where every path is in the ignore list.

Watch out

• Three repos do not yet have the trigger this doc now states as the
  trigger. workflow_dispatch is on haus check, pounce build, perch
  build, trill build, workshop Tests (this PR) and factory test
  (A branch with no PR can still be checked on demand factory#23). It is missing from scruff check.yml, snug
  ci.yml and nebelung check.yml, and nothing catches the gap. One line
  each; filed as its own to-do rather than widened into this PR.
• The Nix store cache section's nebelung bullet still says whiskers "is not
  in cache.nixos.org", which stays literally true after the nebelung
  substituter PR now in flight — but the implication softens, since the store
  cache stops being the only thing between a cold run and 218s of rustc. Worth
  a sentence there once that lands, not before.
• bench overlap is · clear, but another lane is in docs/ci.md
  right now — measure-nix-store, elsewhere in the file (and in
  docs/drift.md). merge-tree is clean against it and against origin/main.
  It looks likely to add a rule about grouping parallel jobs; if it lands
  first, this rebases without touching the same hunks.
• factory tier says not-1 on the factory half (it touches
  .github/workflows), so the lease will not merge either of these. They need a
  go-ahead.
• Docs-only change plus one workflow line, so this repo's own gate cannot
  exercise the dispatch button until it is on main.

🤖 Generated with Claude Code

https://claude.ai/code/session_019v1reBfZd8d4euMNyXry6B