Build a revision once, not once per repository

[frangarcj]

A push to master here fires dispatch-build.yml, and autobuilds then describes that revision, builds the lock through this repository's own build-sdk.yml, and publishes what comes out.

Since #173 removed the hand-written matrix, the build this workflow runs on that same push is the same lock, the same ten legs, the same code. Twice, at the same time, in two repositories.

That was worth having while the two were different paths — two paths give two signals, and the gap between them is exactly what #173 was about. They are one path now, so the second run is only cost. Four full builds were in flight at once this afternoon:

run	revision
buildscripts master Build	93a4d9a23
autobuilds Build SDK snapshots (announced)	93a4d9a23
buildscripts #174 Build	the pin bump
buildscripts #170 Build	the dependabot bump

Half of that is a copy of the other half.

What changes

  build:
    needs: describe
    if: github.event_name != 'push' || github.ref != 'refs/heads/master'

Only a push to master. Every pull request still builds — that is where the build is the signal that decides whether something merges, and it is the only place this workflow's build ever was one. A push to a branch with no pull request open still builds too.

On master the signal moves to the autobuilds run, which is strictly the better one: it applies the required-host policy and says whether the revision is releasable, which this workflow could never do.

package-tests needs build, so it follows it. Everything that reaches master reaches it through a pull request that ran both. The exception is the pin bot, which pushes to master directly — and a pin bump changes no packaging script, while checks still runs on every push either way.

Test

tests/ci/test-single-matrix.sh gains the question, evaluated rather than matched as text — a small reader for the subset of the expression language a job condition uses, then:

• a push to master must not build here
• a pull request must still build

Against master's build.yml it says so:

FAIL: a push to master builds here as well as in autobuilds; that is the same lock twice

All 9 CI tests and 6 protocol tests pass; actionlint is clean.

---

AI tools were used in preparing this PR (Claude Opus 5, Anthropic).