ci: run tests and phpstan on pull requests

Both workflows only triggered on push, so a pull request from a fork ran
no tests and no static analysis at all: the checks appeared on the
branch after a merge, which is the wrong side of the decision. That
matters more than usual here because dependabot-auto-merge.yml runs on
pull_request_target and calls `gh pr merge --auto` for every semver
minor and patch bump, so dependency updates could reach main without a
single test having run against them.

Push is now scoped to main, so a branch that has a pull request open
gets one run rather than two.

Author: danielebarbaro

.github/workflows/phpstan.yml

@@ -2,6 +2,13 @@ name: PHPStan
 
 on:
   push:
+    branches:
+      - main
+    paths:
+      - '**.php'
+      - 'phpstan.neon.dist'
+      - '.github/workflows/phpstan.yml'
+  pull_request:
     paths:
       - '**.php'
       - 'phpstan.neon.dist'

.github/workflows/run-tests.yml

@@ -2,6 +2,15 @@ name: run-tests
 
 on:
   push:
+    branches:
+      - main
+    paths:
+      - '**.php'
+      - '.github/workflows/run-tests.yml'
+      - 'phpunit.xml.dist'
+      - 'composer.json'
+      - 'composer.lock'
+  pull_request:
     paths:
       - '**.php'
       - '.github/workflows/run-tests.yml'