restrict github-push taskcluster events to main (#777)

* restrict github-push taskcluster events to `main`, `release*`, and `dev*`

In https://bugzilla.mozilla.org/show_bug.cgi?id=1907217 we're becoming more explicit about scopes we grant to branches in Github, which means branches that do not show up in the explicit list in fxci-config (https://github.com/mozilla-releng/fxci-config/blob/main/projects.yml) will not be able to start tasks.

* Update documentation and training helper script to take into account supported branches for Taskcluster

.taskcluster.yml

@@ -83,7 +83,8 @@ tasks:
                   else: ${head_ref}
           in:
               $if: >
-                  tasks_for in ["action", "pr-action", "cron", "github-push"]
+                  tasks_for in ["action", "pr-action", "cron"]
+                  || (tasks_for == "github-push" && (head_branch == "refs/heads/main" || head_branch[:18] == "refs/heads/release" || head_branch[:14] == "refs/heads/dev"))
                   || (isPullRequest && pullRequestAction in ["opened", "reopened", "synchronize"])
               then:
                   $let:

docs/task-cluster.md

@@ -14,6 +14,10 @@ which increases scalability and observability compared to [Snakemake](snakemake.
 We use [Taskcluster taskgraph](https://taskcluster-taskgraph.readthedocs.io/en/latest/) to define the DAG
 (Directly Acyclic Graph) of the pipeline steps.
 
+## Development
+
+When making changes to Taskcluster parts of the pipeline it is often necessary to run training before opening a pull request with the change. To do this, ensure that you push your change to a branch of `mozilla/firefox-translations-training` that begins with `dev`. (Only pushes to `main`, `dev*`, and `release*` will run Taskcluster tasks.)
+
 ## Running training
 
 1. Create a new branch in your local git repo and push it to `mozilla/firefox-translations-training`.

utils/train.py

@@ -101,6 +101,11 @@ def main() -> None:
         )
         sys.exit(1)
 
+    if branch != "main" and not branch.startswith("dev") and not branch.startswith("release"):
+        print(
+            f"Branch must be `main` or start with `dev` or `release` for training to run. Detected branch was {branch}"
+        )
+
     timeout = 10
     while True:
         decision_task = get_decision_task_push(branch)