ci: keep automatic package builds out of pull requests

.github/workflows/preview-packages.yml

@@ -4,26 +4,7 @@ run-name: >-
   Cross-platform Preview (${{ inputs.preview_id || format('run-{0}', github.run_number) }})
 
 on:
-  pull_request:
-    # Native tests cover every PR; package only when package inputs change.
-    paths:
-      - "**/Cargo.toml"
-      - "Cargo.lock"
-      - "rust-toolchain.toml"
-      - "nebula_app/build.rs"
-      - "nebula_app/build/**"
-      - "nebula_app/res/**"
-      - "nebula_app/windows/**"
-      - "assets/**"
-      - "packaging/**"
-      - "scripts/package*"
-      - "scripts/build-*"
-      - "scripts/installer*"
-      - "scripts/prepare-windows-runtime.ps1"
-      - "scripts/preview_release.py"
-      - "scripts/conformance/**"
-      - "scripts/tests/test_preview_release.py"
-      - ".github/workflows/preview-packages.yml"
+  # Pull requests use Full native tests; packages are built after merge or on request.
   push:
     branches: [main]
     # Native tests cover every PR; package only when package inputs change.

CONTRIBUTING.md

@@ -107,9 +107,11 @@ cargo check -p nebula --bin pebrel --features gpui-shell --tests --locked
 
 `Full native tests` runs on every PR and merge-group update, and on `main` pushes.
 It tests the full workspace on Linux, Windows x64 / ARM64 and both macOS
-architectures. New commits cancel obsolete PR runs. Package validation has its own
-input filters and can also be dispatched manually; a package job does not replace
-the native test suite. These triggers do not configure required status checks.
+architectures. New commits cancel obsolete PR runs. Pull requests run tests and
+compile checks without building distribution packages. Package validation runs
+after matching changes reach `main`, or by explicit manual dispatch; a package
+job does not replace the native test suite. These triggers do not configure
+required status checks.
 
 GitHub may show **Waiting for approval** for a first-time fork contributor. A
 maintainer must inspect the submitted changes and approve that workflow run from

architecture/notes/packaging/2026-09-23-pr-checks-without-preview-packages.md

@@ -0,0 +1,67 @@
+# Keep automatic package builds out of pull-request checks
+
+## Status
+
+Accepted by the maintainer on 2026-09-23: pull requests run tests and compile
+checks; distribution packages are built after merge or on explicit request.
+
+## Context
+
+Preview packaging subscribed to pull requests that changed package inputs.
+A Windows installer-menu change therefore started Linux and both macOS package
+builds alongside the independent native test matrix. These workflows requested
+the same macOS runner types while required checks were waiting for runners.
+
+## Evidence
+
+- [PR #264](https://github.com/Kuddev/pebrel/pull/264) changed Windows installer
+  scripts and triggered [Preview run 35825643107](https://github.com/Kuddev/pebrel/actions/runs/35825643107).
+- The Preview macOS jobs ran workspace tests, dialog tests and an optimized
+  product build before creating DMGs. The native workflow independently ran
+  workspace tests and checked the production feature graph.
+- The required `Release workspace` jobs execute `cargo check --release`; they
+  do not generate distribution packages and remain required compile checks.
+- Runner waiting is observable. The exact hosted-runner quota or scheduling
+  policy responsible for a particular delay is not established by these logs.
+
+## Decision
+
+Remove the `pull_request` trigger from `preview-packages.yml`. Keep its filtered
+`main` push trigger and explicit `workflow_dispatch`, including all package and
+runtime conformance validation. Public Preview publication still requires an
+explicit dispatch with publication enabled. Stable release triggers are retained.
+
+The native PR and merge-group workflows retain their test coverage. This change
+does not alter required-check names or server-side protection rules.
+
+## Rejected alternatives
+
+- Cancel required macOS checks to merge sooner: loses required validation.
+- Treat the release-profile compile checks as package creation: these commands
+  validate a different build profile without creating installers or archives.
+- Remove package conformance tests: package behavior still needs verification
+  when a package is actually requested.
+
+## Consequences
+
+Pull requests no longer automatically provide Preview installation artifacts.
+Maintainers can explicitly dispatch package validation for a candidate branch.
+Already queued workflows must be handled separately; changing a trigger cannot
+retroactively cancel them. This change does not remove duplicate native runs
+when a draft becomes ready, or guarantee a fixed runner wait time.
+
+## Validation
+
+The native-suite workflow contract verifies that Preview has only filtered main
+push and manual triggers, that stable release remains tag/manual, and that native
+PR and merge-group checks remain unfiltered. Restoring the previous PR package
+trigger must fail the new regression.
+
+## Supersedes
+
+The previous automatic Preview build policy for pull-request package-input changes.
+
+## Revisit when
+
+An explicit request for per-PR artifacts can be implemented with bounded platform
+selection and a separate runner budget without delaying mandatory validation.

scripts/tests/test_ci_native_tests.py

@@ -11,6 +11,24 @@ from scripts.ci_native_tests import main, native_commands
 
 
 class NativeSuiteTests(unittest.TestCase):
+    def test_packages_run_after_merge_or_manual_dispatch_not_for_prs(self):
+        root = Path(__file__).resolve().parents[2]
+        workflow = (root / ".github/workflows/preview-packages.yml").read_text()
+        events = workflow.split("\non:\n", 1)[1].split("\nconcurrency:", 1)[0]
+        triggers = set(re.findall(r"^  ([a-z_]+):", events, re.M))
+        self.assertEqual(triggers, {"push", "workflow_dispatch"})
+        push = re.search(r"^  push:(.*?)(?=^  [a-z_]+:|\Z)", events, re.M | re.S)
+        self.assertIsNotNone(push)
+        self.assertIn("branches: [main]", push.group(1))
+        self.assertIn("paths:", push.group(1))
+        # Packaging still needs explicit dispatch to create a public release.
+        self.assertIn("github.event_name == 'workflow_dispatch' && inputs.publish == true", workflow)
+        stable = (root / ".github/workflows/release.yml").read_text()
+        stable_events = stable.split("\non:\n", 1)[1].split("\nconcurrency:", 1)[0]
+        self.assertEqual(set(re.findall(r"^  ([a-z_]+):", stable_events, re.M)),
+                         {"push", "workflow_dispatch"})
+        self.assertIn('tags: ["v*.*.*"]', stable_events)
+
     def test_every_pr_and_merge_group_runs_without_path_exclusions(self):
         root = Path(__file__).resolve().parents[2]
         workflow = (root / ".github/workflows/linux-lua.yml").read_text()