URGENT: Align ci.yml with zkcoins/server patterns — concurrency, single-branch trigger, paths-ignore

[TaprootFreak]

Priority: Urgent + Important

Comparison against zk-coins/server/.github/workflows/ci.yaml surfaced three missing safeguards in dfx-wallet/.github/workflows/ci.yml. Each one is wasting CI minutes today; we hit all three in the past 48 hours during the Maestro-stabilisation + Dependabot wave.

Gap 1 — No concurrency block in CI (highest impact)

maestro-e2e.yml and visual-regression.yml cancel superseded runs. ci.yml does not. Every force-push (rebase) launches a fresh set of 7 jobs (typecheck, lint, format, test, audit, bundle-mvp, bundle-full) while the previous set keeps running to completion. Yesterday's #155 rebase alone burned ~14 redundant job-runs.

zkcoins/server/ci.yaml lines 16–18 (proven pattern):

concurrency:
  group: ci-${{ github.event.pull_request.head.sha || github.sha }}
  cancel-in-progress: true

Gap 2 — CI triggers on both main and develop

Current:

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

zkcoins explicitly switched to [develop] only and documented why (zkcoins/server/ci.yaml lines 5–14):

Only trigger on PRs targeting develop (feature → develop). The release PR (develop → main) is opened automatically and would otherwise fire a second CI run for every push to develop — those duplicate runs surfaced as "fail" entries on the release PR's check list whenever the concurrency block cancelled the older one.

We see this today on PR #94 (Release develop→main): every push to develop fires pull_request on the release PR and push on develop, doubling the work.

Suggested:

on:
  push:
    branches: [develop]
  pull_request:
    branches: [develop]

Gap 3 — No paths-ignore in CI

maestro-e2e.yml already ignores doc-only changes (markdown, docs/**, ISSUE_TEMPLATE, PULL_REQUEST_TEMPLATE). ci.yml does not, so the recent docs PRs (#154 Maestro guide, #158 handbook) burned the entire 7-job CI matrix despite touching no JS/TS.

Suggested for ci.yml:

on:
  push:
    branches: [develop]
    paths-ignore:
      - '**/*.md'
      - 'docs/**'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/PULL_REQUEST_TEMPLATE.md'
  pull_request:
    branches: [develop]
    paths-ignore:
      - '**/*.md'
      - 'docs/**'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/PULL_REQUEST_TEMPLATE.md'

Quick-Win Ranking

#	Change	Estimated CI-minute savings per week
1	Concurrency block	~40 minutes (force-pushes happen ~5×/week)
2	Drop main from triggers	~20 minutes (each develop push hits Release-PR)
3	paths-ignore	~10 minutes (docs PRs are sporadic)

Asks

• Add concurrency block to ci.yml (Gap 1)
• Restrict ci.yml triggers to develop only (Gap 2)
• Add paths-ignore to ci.yml triggers (Gap 3)
• Consider applying Gaps 1–3 to codeql.yml too (it has neither concurrency nor paths-ignore)
• Verify with one test push that the Release-PR (chore(release): develop -> main #94) check list no longer double-counts CI

Reference: zk-coins/server/.github/workflows/ci.yaml is a clean pattern to mirror.