ci(lstt): run formatting on develop pushes, not just PRs

[marifamd]

Motivation

amdsmi-license-headers is pass_filenames: false, so it rescans the whole tree.
Once a violation lands on develop, every later PR goes red instead of the merge
that caused it. #10010 merged on a stale-green formatting run and reddened #10973
and #10998 until #8561 fixed the headers. Third time against this hook (#10402,
#10845, #8561), each fixed reactively.

Technical Details

.github/workflows/lstt-formatting.yml:

• push trigger on develop, same path filter as pull_request, so a whole-tree
  hook runs on the merge commit.
• --from-ref is event-aware via FROM_REF: github.event.before on push, base
  branch on PR. PR behavior unchanged.
• cancel-in-progress limited to pull_request, so consecutive merges each keep
  their verdict.

Detection at merge, not prevention. Prevention is "Require branches to be up to
date before merging" — develop has no branch protection at all today (the
protection API returns 404), which is how the stale-green merge happened.

Known gap: github.event.before is unguarded, so a branch re-create or force-push
gives pre-commit a zero/unreachable SHA and it exits 128. Loud, not silent.
Follow-up can fall back to the base branch on github.event.created/forced.

JIRA ID

N/A (CI hygiene). Drift origin #10010, headers fixed by #8561.

Test Plan / Result

• pre-commit run --from-ref origin/develop --to-ref HEAD in projects/amdsmi — passes.
• python3 projects/amdsmi/tests/check_license_headers.py — clean.
• Parsed the YAML and checked the resolved expressions per event: FROM_REF gives
  github.event.before on push and origin/<base> on PR; cancel-in-progress is
  false on push, true on PR.
• pre-commit run --from-ref 0000000000000000000000000000000000000000 reproduces
  the exit-128 gap above.

[therock-pr-bot]

✅ All Policy Checks Passed

Check	Status	Details
📝 PR Description	✅ Pass	—
⛔ Forbidden Files	✅ Pass	—
🧪 Unit Test	✅ Pass	PR does not contain code files — Unit Test auto-passed
🚫 Draft PR	🔜 To Be Enabled	—
🚩 Feature Flag	🔜 To Be Enabled	—
📊 Code Coverage	🔜 To Be Enabled	—

🎉 All policy checks passed!

📖 Need help? See the Policy FAQ for details on every check and how to fix failures.

🙋 Wish to Override Policy?

[dmitrii-galantsev]

claude: rebase looks right — only the workflow change is left, the headers landed independently via #8561.

Two things from testing it:

1. FROM_REF on push takes github.event.before unguarded. On a branch create or force-push that is the zero SHA, and pre-commit --from-ref 0000... exits 128 (fatal: Invalid revision range). Narrow for develop and it fails loud, so not a blocker.

2. Worth knowing before fixing 1: amdsmi-license-headers is pass_filenames: false but has no always_run, so it only fires when the diff range contains a file matching its files: pattern. Falling back to origin/develop on a develop push gives an empty range and silently skips the hook — fail-open, which defeats the purpose. HEAD~1 keeps it firing. Your call on which tradeoff you want; that is why I did not just push a guard.

FWIW amdsmi-manylinux-build.yml already uses the same push-on-develop + per-event cancel-in-progress pattern, so this is consistent with existing practice.