💚 Fix logic gaps

A tag push triggered all 3 workflows when it should only trigger prerelease or release workflows.

Author: mkarlesky

.github/workflows/_publish-gem.yml

@@ -107,6 +107,7 @@ jobs:
       - name: Publish GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          draft: true # Temporary for testing
           prerelease: ${{ inputs.prerelease }}
           files: ceedling-*.gem
 

.github/workflows/ci.yml

@@ -31,10 +31,13 @@
 ---
 name: CI
 
-# Triggers the workflow on push to any branch, pull requests targeting master,
-# or manual dispatch
+# Triggers the workflow on push to any branch (tag pushes excluded — handled by
+# prerelease.yml and release.yml), pull requests targeting master, or manual dispatch
 on:
-  push:                  # All branches — no branch filter; see Skip-CI above
+  push:
+    branches:
+      - '**'             # All branches; branches: ['**'] scopes push to refs/heads/ only,
+                         # excluding refs/tags/ pushes — see Skip-CI above
   pull_request:
     branches: [master]
   workflow_dispatch:

.github/workflows/release.yml

@@ -41,12 +41,15 @@
 ---
 name: Release
 
-# Triggers on release tag pattern; see 'if' guard on publish job for the
-# second line of defense against pre-release tags matching this glob
+# Triggers on release tag pattern only.
+# Primary defense: the negative pattern '!v*.*.*-*' excludes any tag containing
+# a hyphen (e.g. v1.0.0-pre.1), which would otherwise match the v*.*.* glob.
+# Fallback defense: the 'if' guard on the publish job also rejects hyphenated tags.
 on:
   push:
     tags:
       - 'v*.*.*'
+      - '!v*.*.*-*'   # Exclude pre-release tags (e.g. v1.0.0-pre.1, v1.0.0-beta.1)
 
 
 # contents: write is required to create and upload GitHub releases