Repository: cli/cli

Issue:
Ensure pull requests do not run redundant GitHub Actions workflows
## Overview

Both the [Lint](https://github.com/cli/cli/actions/workflows/lint.yml) and [Unit and Integration Tests](https://github.com/cli/cli/actions/workflows/go.yml) workflows run on `push` and `pull_request` events.  Unfortunately, these workflows run 2 sets of jobs on pull requests because the `push` event trigger is not restricted to `trunk` branch.

For example, the [checks](https://github.com/cli/cli/pull/11306/checks) from #11306 demonstrates 7 redundant checks including `build`, `integration-tests`, and `lint` are performed:

<img width="1042" height="1147" alt="Image" src="https://github.com/user-attachments/assets/5215f0fa-d1e7-4997-bd92-0e05bb8b3160" />

Reasons for not having redundant GitHub Actions workflow runs on PRs:

- reduce wasted compute resources
- remove potential problems caused by errors from redundant jobs
- improve clarity of PR status
- improve user experience of PR reviews

During discussion with maintainers, other maintainers agreed it was still valuable for these workflows to run when `push` to `trunk` branch happen especially for changes made outside of PRs.

## Expected outcome

- Aforementioned workflows only run once during pull requests
- Aforementioned workflows run on pushes to `trunk` branch

Hints from issue comments:

Solution patch:
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 9b22701a7..7772b3814 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -1,5 +1,9 @@
 name: Unit and Integration Tests
-on: [push, pull_request]
+on:
+  push:
+    branches:
+      - trunk
+  pull_request:
 
 permissions:
   contents: read
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 866dc3a2d..0b5d18882 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,6 +1,8 @@
 name: Lint
 on:
   push:
+    branches:
+      - trunk
     paths:
       - "**.go"
       - go.mod



Test patch:
diff --git a/pkg/cmd/release/shared/attestation.go b/pkg/cmd/release/shared/attestation.go
index 4e0377fed..b4490373b 100644
--- a/pkg/cmd/release/shared/attestation.go
+++ b/pkg/cmd/release/shared/attestation.go
@@ -46,7 +46,7 @@ func (v *AttestationVerifier) VerifyAttestation(art *artifact.DigestedArtifact,
 		return nil, err
 	}
 
-	policy := buildVerificationPolicy(*art)
+	policy := buildVerificationPolicy(*art, td)
 	sigstoreVerified, err := verifier.Verify([]*api.Attestation{att}, policy)
 	if err != nil {
 		return nil, err
@@ -99,9 +99,13 @@ func FilterAttestationsByFileDigest(attestations []*api.Attestation, fileDigest
 }
 
 // buildVerificationPolicy constructs a verification policy for GitHub releases
-func buildVerificationPolicy(a artifact.DigestedArtifact) verify.PolicyBuilder {
+func buildVerificationPolicy(a artifact.DigestedArtifact, trustDomain string) verify.PolicyBuilder {
+	// If no trust domain is specified, default to "dotcom"
+	if trustDomain == "" {
+		trustDomain = "dotcom"
+	}
 	// SAN must match the GitHub releases domain. No issuer extension (match anything)
-	sanMatcher, _ := verify.NewSANMatcher("", "^https://.*\\.releases\\.github\\.com$")
+	sanMatcher, _ := verify.NewSANMatcher("", fmt.Sprintf("^https://%s\\.releases\\.github\\.com$", trustDomain))
 	issuerMatcher, _ := verify.NewIssuerMatcher("", ".*")
 	certId, _ := verify.NewCertificateIdentity(sanMatcher, issuerMatcher, certificate.Extensions{})