ci: give the dev branch the same workflow coverage as main

.github/actions/environment-check/action.yml

@@ -340,8 +340,8 @@ runs:
         echo "===== Cache Content Summary ====="
         du -sh "$RUNNER_TEMP/dvledtx-deps" || true
 
-    - name: Save environment cache (main branch only)
-      if: steps.env-cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main'
+    - name: Save environment cache (main and dev branches)
+      if: steps.env-cache.outputs.cache-hit != 'true' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
       uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: |

.github/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
   push:
     branches:
       - main
+      - dev
     tags:
       - '*'
   workflow_dispatch:

.github/workflows/coverity.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   coverity:
-    name: Coverity Scan
+    name: Coverity Scan (${{ github.event.repository.default_branch }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -36,10 +36,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.sha }}
+          ref: refs/heads/${{ github.event.repository.default_branch }}
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Resolve scanned commit
+        id: scanned
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
       - name: Environment check
         uses: ./.github/actions/environment-check
 
@@ -55,3 +59,6 @@ jobs:
         with:
           sarif_file: reports/coverity-results.sarif
           category: coverity
+          # The workflow runs on the default branch, so the scanned ref must be stated explicitly.
+          ref: refs/heads/${{ github.event.repository.default_branch }}
+          sha: ${{ steps.scanned.outputs.sha }}

.github/workflows/daily_build.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   build:
-    name: Daily Build
+    name: Daily Build (${{ github.event.repository.default_branch }})
     runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:
@@ -37,7 +37,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.sha }}
+          ref: refs/heads/${{ github.event.repository.default_branch }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -72,12 +72,12 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
-          name: DVLED-SW-TK-DailyBuild-${{ github.run_id }}
+          name: DVLED-SW-TK-DailyBuild-${{ github.event.repository.default_branch }}-${{ github.run_id }}
           path: ${{ github.workspace }}/reports/
           retention-days: 30
 
   afl-fuzz:
-    name: Daily AFL Fuzz
+    name: Daily AFL Fuzz (${{ github.event.repository.default_branch }})
     runs-on: ubuntu-latest
     # 2h of fuzzing plus headroom for dependency install and the harness build.
     timeout-minutes: 138
@@ -88,7 +88,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.sha }}
+          ref: refs/heads/${{ github.event.repository.default_branch }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -101,12 +101,12 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
-          name: afl-fuzz-results-${{ github.run_id }}
+          name: afl-fuzz-results-${{ github.event.repository.default_branch }}-${{ github.run_id }}
           path: fuzz/findings/
           retention-days: 14
 
   libfuzzer:
-    name: Daily libFuzzer
+    name: Daily libFuzzer (${{ github.event.repository.default_branch }})
     runs-on: ubuntu-latest
     # max-seconds applies per sanitizer mode (ASan + UBSan), so the fuzzing
     # itself takes ~2h; the rest covers the two builds.
@@ -118,7 +118,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.sha }}
+          ref: refs/heads/${{ github.event.repository.default_branch }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -131,7 +131,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
-          name: libfuzzer-results-${{ github.run_id }}
+          name: libfuzzer-results-${{ github.event.repository.default_branch }}-${{ github.run_id }}
           path: |
             fuzz/libfuzzer_corpus/
             fuzz/ubsan_corpus/

.github/workflows/pull_request.yml

@@ -10,6 +10,7 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     branches:
       - main
+      - dev
 
   workflow_dispatch:
 

.github/workflows/scorecard.yml

@@ -9,6 +9,7 @@ on:
   push:
     branches:
       - main
+      - dev
   schedule:
     # Weekly on Monday at 06:30 UTC
     - cron: '30 6 * * 1'
@@ -40,7 +41,8 @@ jobs:
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
-          publish_results: true
+          # The Scorecard API only accepts results published from the default branch.
+          publish_results: ${{ github.ref_name == github.event.repository.default_branch }}
           repo_token: ${{ secrets.SCORECARD_TOKEN }}
 
       - name: Upload SARIF to Security tab