Skip Codecov uploads for pushes to non-default branches - #37

When a PR comes from a branch in the same repository, CI runs twice for the same commit:

• the push run tests the branch as is;
• the pull_request run tests GitHub's merge with the base branch.

Both upload to Codecov under the same commit SHA, and Codecov merges the two reports even though they cover different versions of the code. If the base branch has moved on, the result is corrupted. For example, zigpy/zigpy#1909's report lists zigpy/appdb.py with 1007 coverable lines: the union of the 629-line version on the PR's base and the 666-line version on current dev. The PR doesn't touch that file, but the inflated misses fail codecov/project with "indirect changes".

This PR skips the upload for push events on anything but the repository's default branch:

• PRs, from forks or from the same repository, now upload from their pull_request run only, the same way PRs from forks already do today.
• Pushes to the default branch still upload, so PRs keep a base report to compare against.
• Runs inside forked repositories are still skipped (Don't upload to Codecov in forks #27). Other events (merge_group, workflow_dispatch) behave as before.

Limitations

• Base comparison: Codecov still compares the PR's merge tree with the commit the PR branched from. So when the base branch has moved on, its newer changes can still show up as indirect changes, but as a consistent report instead of a corrupted one. That's what PRs from forks get today.
• PRs from the default branch itself (e.g. a dev → master release PR) still upload twice: once from the dev push and once from the PR. That's harmless when the base branch has no commits missing from dev, since both uploads then cover the same code.
• Side effect: pushes to other branches or tags (release tags, feature branches without a PR) no longer upload coverage. Tests still run there, and the --fail-under check still applies.

The workflow passes actionlint (the only warning is the existing one about CODE_FOLDER), which only checks the condition's syntax; its behavior shows in real runs.

Affected repositories

Repositories in the org that call this workflow with push: on all branches get the double upload: zigpy, bellows, zigpy-znp, zigpy-deconz, zigpy-xbee, zigpy-zigate, zigpy-cli and zigpy-ziggurat. zha, zha-device-handlers and zigpy-ota already limit push: to their main branches, so they don't. Outside the org, NabuCasa/universal-silabs-flasher, smlight-tech/pysmlight, smlight-tech/smlight-cc-flasher and lhespress/zigpy-espzb also call it with all-branch pushes, so they get the same change.

Alternative or addition: per-repository triggers

Instead of this change, or in addition to it, each affected repository could limit its own push: trigger to its main branch, as zha does. That also removes the duplicate test runs, but branches pushed without a PR would then get no CI at all. Those would be separate PRs in each repository; I can open them if that's preferred.