Trim CI config

With the old configuration, we would run CI twice when pushing a commit and
opening a pull request. Or when pushing a commit that belongs to a pull request.

With the new configuration, we run CI once when opening a PR, and once when
pushing a commit that belongs to a pull request. And once when merging to
master (the `push` event). Importantly, this configuration still works for
contributions from forked repositories, since the `pull_request` events are
triggered on _our_ fork.

.github/workflows/ci.yml

@@ -1,6 +1,11 @@
 name: CI
 
-on: [pull_request, push, workflow_dispatch]
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
 
 jobs:
   specs:
@@ -23,7 +28,7 @@ jobs:
     env:
       BUNDLE_GEMFILE: gemfiles/${{ matrix.gemfile }}.gemfile
     steps:
-      - uses: zendesk/checkout@v2
+      - uses: zendesk/checkout@v4
       - name: Set up Ruby
         uses: zendesk/setup-ruby@v1
         with: