chore(ci): stop release and CodeQL runs on PRs, drop deploy smoke tests

The release matrix (7 Linux cross-builds + a CGO Windows build) ran on every
PR and on every branch push, so a PR from a repo branch built everything
twice. Release binaries now build only on main (dev channel) and version
tags; any other branch can still be built via workflow_dispatch.

CodeQL keeps its push-to-main and weekly scans but no longer runs per PR.

The deploy smoke workflow fired on every Release completion only to skip
its jobs; deploy/test/smoke-noninteractive.sh stays for manual runs.

.github/workflows/codeql.yml

@@ -11,12 +11,6 @@ on:
       - "go.mod"
       - "go.sum"
       - "frontend/**"
-  pull_request:
-    paths:
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
-      - "frontend/**"
   schedule:
     - cron: "18 2 * * 2"
 
@@ -24,8 +18,6 @@ jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    env:
-      CODEQL_ACTION_FILE_COVERAGE_ON_PRS: true
     permissions:
       security-events: write
       packages: read

.github/workflows/release.yml

@@ -2,9 +2,11 @@ name: Release 3X-UI
 
 on:
   workflow_dispatch:
+  # Only main (dev channel) and version tags ship binaries; build any other
+  # branch on demand via workflow_dispatch.
   push:
     branches:
-      - "**"
+      - main
     tags:
       - "v*.*.*"
     paths:
@@ -17,17 +19,6 @@ on:
       - "x-ui.service.arch"
       - "x-ui.service.rhel"
       - ".github/workflows/release.yml"
-  pull_request:
-    paths:
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
-      - "**.sh"
-      - "frontend/**"
-      - "x-ui.service.debian"
-      - "x-ui.service.arch"
-      - "x-ui.service.rhel"
-      - ".github/workflows/release.yml"
 
 jobs:
   build:

.github/workflows/smoke.yml

@@ -1,69 +0,0 @@
-name: Deploy Smoke Tests
-
-# Container smoke test for the unattended (cloud-init) install path.
-# Runs when the install/deploy assets change on a branch push or PR, and
-# again after a release-tag build finishes uploading its assets — passing the
-# tag as an explicit version, so the green result verifies the release
-# actually being shipped. That job deliberately runs the script from the
-# default branch rather than checking out the tag: workflow_run executes in
-# main's cache scope, so executing checked-out code there is a cache-poisoning
-# surface (CodeQL actions/cache-poisoning/poisonable-step), and users pipe
-# main's install.sh anyway.
-# Tag pushes must NOT trigger the unpinned job directly: at that moment
-# releases/latest still points at the previous release (#5756), and a `paths`
-# filter alone cannot exclude them because a brand-new tag ref has no diff
-# base, so it runs on every tag push.
-
-on:
-  push:
-    branches:
-      - "**"
-    paths:
-      - "install.sh"
-      - "deploy/**"
-      - ".github/workflows/smoke.yml"
-  pull_request:
-    paths:
-      - "install.sh"
-      - "deploy/**"
-      - ".github/workflows/smoke.yml"
-  workflow_run:
-    workflows: ["Release 3X-UI"]
-    types: [completed]
-
-permissions:
-  contents: read
-
-jobs:
-  noninteractive-install:
-    if: github.event_name != 'workflow_run'
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-latest, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v7
-      - name: Non-interactive install smoke test
-        run: bash deploy/test/smoke-noninteractive.sh
-
-  release-tag-install:
-    if: >-
-      github.event_name == 'workflow_run' &&
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      startsWith(github.event.workflow_run.head_branch, 'v') &&
-      contains(github.event.workflow_run.head_branch, '.')
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-latest, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v7
-      - name: Pinned release install smoke test
-        env:
-          XUI_SMOKE_VERSION: ${{ github.event.workflow_run.head_branch }}
-        run: bash deploy/test/smoke-noninteractive.sh "$XUI_SMOKE_VERSION"

docs/architecture.md

@@ -292,7 +292,7 @@ node heartbeat every 5s, periodic traffic resets (hourly/daily/weekly/monthly).
 ├── install.sh / update.sh / x-ui.sh                        # VPS install + management CLI
 ├── x-ui.service.*  / x-ui.rc                               # systemd units (debian/rhel/arch) + rc script
 ├── windows_files/                                          # Windows service support
-└── .github/workflows/        # CI: ci.yml, codeql.yml, docker.yml, release.yml, smoke.yml,
+└── .github/workflows/        # CI: ci.yml, codeql.yml, docker.yml, release.yml,
                               #     mutation.yml, cleanup_caches.yml, claude-pr-review.yml,
                               #     claude-issue-analyst.yml
 ```
@@ -583,7 +583,7 @@ root → `go build ./...` / `go run main.go`.
 **Docker:** `docker compose up -d` (uses `Dockerfile` + `DockerEntrypoint.sh`).
 
 **CI** (`.github/workflows/`): `ci.yml` (build/test/lint), `codeql.yml` (security scan),
-`smoke.yml` (smoke tests), `mutation.yml` (mutation testing), `docker.yml` + `release.yml`
+`mutation.yml` (mutation testing), `docker.yml` + `release.yml`
 (multi-arch image + release builds), `cleanup_caches.yml`, `claude-pr-review.yml` (PR review
 only - it changes no code), `claude-issue-analyst.yml` (issue triage).