CI: Do not run on pushes to main

All merges go through the merge queue, which already tested the
identical commit on the merge group branch. The nix caches can only be
refreshed from main, so a dedicated workflow keeps running there.

Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

Author: mkannwischer

.github/workflows/all.yml

@@ -6,8 +6,6 @@ permissions:
   contents: read
 on:
   workflow_dispatch:
-  push:
-    branches: ["main"]
   pull_request:
     branches: ["main"]
     types: [ "opened", "synchronize" ]

.github/workflows/hol_light.yml

@@ -5,22 +5,6 @@ name: HOL-Light
 permissions:
   contents: read
 on:
-  push:
-    branches: ["main"]
-    paths:
-     - '.github/workflows/hol_light.yml'
-     - 'proofs/hol_light/common/**/*.ml'
-     - 'proofs/hol_light/aarch64/Makefile'
-     - 'proofs/hol_light/aarch64/**/*.S'
-     - 'proofs/hol_light/aarch64/**/*.ml'
-     - 'proofs/hol_light/common/**/*.ml'
-     - 'proofs/hol_light/x86_64/Makefile'
-     - 'proofs/hol_light/x86_64/**/*.S'
-     - 'proofs/hol_light/x86_64/**/*.ml'
-     - 'flake.nix'
-     - 'flake.lock'
-     - 'nix/hol_light/*'
-     - 'nix/s2n_bignum/*'
   pull_request:
     branches: ["main"]
     paths:

.github/workflows/nix_cache.yml

@@ -0,0 +1,22 @@
+# Copyright (c) The mldsa-native project authors
+# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+
+# The nix caches are only refreshed from main, and CI does not run on
+# pushes to main as merges are already tested in the merge queue.
+
+name: Nix cache
+permissions:
+  contents: read
+on:
+  push:
+    branches: ["main"]
+
+jobs:
+  nix:
+    name: Nix
+    permissions:
+      actions: 'write'
+      contents: 'read'
+      id-token: 'write'
+    uses: ./.github/workflows/nix.yml
+    secrets: inherit