update sonar workflow

.github/workflows/auto-close-external-prs.yml

@@ -3,11 +3,10 @@ name: "Auto-Close External PRs"
 on:
   pull_request_target:
     types: [opened]
-  workflow_dispatch:
 
 jobs:
   close-on-open:
-    if: github.event_name == 'pull_request_target' && github.event.pull_request.user.login != github.repository_owner
+    if: github.event.pull_request.user.login != github.repository_owner
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
@@ -28,31 +27,4 @@ jobs:
               repo: context.repo.repo,
               pull_number: pr,
               state: "closed"
-            });
-
-  sweep-existing:
-    if: github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-      issues: write
-    steps:
-      - uses: actions/github-script@v7
-        with:
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const prs = await github.paginate(github.rest.pulls.list, {
-              owner, repo, state: 'open', per_page: 100
-            });
-            for (const pr of prs) {
-              if (pr.user.login === owner) continue;
-              core.info(`Closing PR #${pr.number} by ${pr.user.login}`);
-              await github.rest.issues.createComment({
-                owner, repo, issue_number: pr.number,
-                body: "Thanks for the interest! This repository isn't currently accepting external contributions as I am actively experimenting with different approaches and want to avoid merge conflicts. Therefore, this PR is being closed automatically by Github Bot."
-              });
-              await github.rest.pulls.update({
-                owner, repo, pull_number: pr.number, state: "closed"
-              });
-            }
+            });

.github/workflows/sonar.yml

@@ -1,10 +1,11 @@
 on:
   # Triggered on completion of the Build workflow so we can consume its
-  # coverage artifact. workflow_run fires regardless of whether the upstream
-  # was triggered by push or pull_request.
+  # coverage artifact. Limited to runs against main so we only scan the
+  # mainline; PR builds don't trigger Sonar.
   workflow_run:
     workflows: ["Build"]
     types: [completed]
+    branches: [main]
 
 name: SonarCloud Scan