ci: Run dev.yml, sterile.yml workflows on pull_request

.github/workflows/bump.yml

@@ -1,4 +1,8 @@
+# Check for Cargo dependencies updates, and automatically open a Pull Request
+# if updates are found.
+
 name: "bump.yml"
+
 on:
   workflow_dispatch:
     inputs:
@@ -19,9 +23,10 @@ concurrency:
 
 permissions:
   contents: "write"
-  pull-requests: "write"
   packages: "read"
   id-token: "write"
+  pull-requests: "write"
+
 jobs:
   update:
     runs-on: "ubuntu-latest"

.github/workflows/dev.yml

@@ -8,7 +8,12 @@
 # Production artifacts are produced in a sterile environment (in another CI workflow).
 
 name: "dev.yml"
+
 on:
+  pull_request: {}
+  push:
+    branches:
+      - "main"
   merge_group:
   workflow_dispatch:
     inputs:
@@ -17,10 +22,9 @@ on:
         description: "Run with tmate enabled"
         required: false
         default: false
-  push: {}
 
 concurrency:
-  group: "${{ github.workflow }}:${{ github.ref }}"
+  group: "${{ github.workflow }}:${{ github.event.pull_request.number || github.event.after }}"
   cancel-in-progress: true
 
 permissions:
@@ -31,6 +35,8 @@ permissions:
 jobs:
   check_changes:
     name: "Deduce required tests from code changes"
+    permissions:
+      pull-requests: "read"
     runs-on: "ubuntu-latest"
     outputs:
       devfiles: "${{ steps.changes.outputs.devfiles }}"
@@ -39,7 +45,7 @@ jobs:
         if: "${{ !github.event.pull_request }}"
         uses: "actions/checkout@v4"
         with:
-          persist-credentials: "true"
+          persist-credentials: "false"
           fetch-depth: "0"
       - name: "Check code changes"
         uses: "dorny/paths-filter@v3"
@@ -172,5 +178,3 @@ jobs:
         run: |
           >&2 echo "A critical step failed!"
           exit 1
-
-

.github/workflows/docs.yml

@@ -1,16 +1,22 @@
+# Build and deploy the dataplane design documentation.
+# Publish a new version of the docs for pushes to "main", or deploy a preview
+# when the workflow runs for a Pull Request.
+
 name: "docs.yml"
 
 on:
+  pull_request: {}
+  push:
+    branches:
+      - "main"
+  merge_group:
   workflow_dispatch:
     inputs:
       debug_enabled:
         type: "boolean"
-        description: "Run the build with tmate debugging enabled"
-  pull_request: { }
-  merge_group:
-  push:
-    branches:
-      - "main"
+        description: "Run with tmate enabled"
+        required: false
+        default: false
 
 concurrency:
   group: "${{ github.workflow }}:${{ github.event.pull_request.number || github.event.after }}"

.github/workflows/mergeability.yml

@@ -1,3 +1,5 @@
+# Block Pull Request merge (by failing the check) if specific labels are set.
+
 name: Mergeability
 
 on:

.github/workflows/sterile.yml

@@ -1,9 +1,14 @@
 # This is a sterile build and test workflow that uses the `dev-env` container image
 # to build and test the project in a sterile environment.
 # Artifacts produced by this workflow are intended to be used for production.
+
 name: "sterile.yml"
+
 on:
+  pull_request: {}
   push:
+    branches:
+      - "main"
   merge_group:
   workflow_dispatch:
     inputs:
@@ -14,7 +19,7 @@ on:
         default: false
 
 concurrency:
-  group: "${{ github.workflow }}:${{ github.ref }}"
+  group: "${{ github.workflow }}:${{ github.event.pull_request.number || github.event.after }}"
   cancel-in-progress: true
 
 jobs:
@@ -28,7 +33,7 @@ jobs:
         if: "${{ !github.event.pull_request }}"
         uses: "actions/checkout@v4"
         with:
-          persist-credentials: "true"
+          persist-credentials: "false"
           fetch-depth: "0"
       - name: "Check code changes"
         uses: "dorny/paths-filter@v3"
@@ -240,4 +245,3 @@ jobs:
         run: |
           >&2 echo "One or more required pushes failed"
           exit 1
-