workflow fixup

Signed-off-by: Brian DeHamer <bdehamer@github.com>

.github/workflows/check-dist.yml

@@ -10,10 +10,12 @@
 name: Check Transpiled JavaScript
 
 on:
+  pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
-  pull_request:
 
 permissions:
   contents: read

.github/workflows/ci.yml

@@ -2,6 +2,8 @@ name: Continuous Integration
 
 on:
   pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
@@ -25,7 +27,7 @@ jobs:
         id: setup-node
         uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
-          node-version: 18
+          node-version-file: .node-version
           cache: npm
 
       - name: Install Dependencies
@@ -67,4 +69,4 @@ jobs:
           predicate-type: 'https://spdx.dev/Document/v2.3'
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Dump output
-        run: jq < ${{ steps.attest.outputs.bundle-path }}
+        run: jq < ${{ steps.attest.outputs.bundle-path }}

.github/workflows/codeql-analysis.yml

@@ -1,10 +1,10 @@
 name: CodeQL
 
 on:
-  push:
+  pull_request:
     branches:
       - main
-  pull_request:
+  push:
     branches:
       - main
   schedule:

.github/workflows/linter.yml

@@ -2,6 +2,8 @@ name: Lint Codebase
 
 on:
   pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
@@ -36,7 +38,7 @@ jobs:
 
        - name: Build @actions/attest
         run: npm run build --workspace packages/attest
-        
+
       - name: Lint Codebase
         id: super-linter
         uses: super-linter/super-linter/slim@v6