ci: avoid dependabot-only failures in conda/docker (#1130)

Author: MilesCranmerBot

.github/workflows/CI.yml

@@ -116,7 +116,9 @@ jobs:
         shell: bash -l {0}
     strategy:
       matrix:
-        python-version: ['3']
+        # NOTE: pin to a known-supported CPython; `3` can resolve to free-threaded
+        # builds (e.g. 3.14t) which PythonCall.jl doesn't support.
+        python-version: ['3.13']
         os: ['ubuntu-latest']
 
     steps:

.github/workflows/CI_conda_forge.yml

@@ -20,7 +20,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.10', '3']
+        # NOTE: pin to avoid free-threaded Python variants (e.g. 3.14t)
+        python-version: ['3.10', '3.13']
         os: ['ubuntu-latest', 'windows-latest', 'macos-latest']
 
     steps:

.github/workflows/docker_deploy.yml

@@ -5,7 +5,8 @@ on:
     - cron: "0 10 * * *"
   push:
     branches:
-      - "**"
+      - "master"
+      - "release-*"
     tags:
       - "v*.*.*"
   workflow_dispatch: