always use the compiler's -dwarf=false flag

First, our original append line was completely ineffective; we never
used that "flags" slice again. Second, we only attempted to use the flag
when we obfuscated a package.

In fact, we never care about debugging information here, so for any
package we compile, we can add "-dwarf=false". At the moment, we compile
all packages, even if they aren't to be obfuscated, due to the lack of
access to the build cache.

As such, we save a significant amount of work. The numbers below were
obtained on a quiet machine with "go test -bench=. -benchtime=10x", six
times before and after the change.

	name     old time/op       new time/op       delta
	Build-8        2.06s ± 4%        1.87s ± 2%  -9.21%  (p=0.002 n=6+6)

	name     old sys-time/op   new sys-time/op   delta
	Build-8        1.51s ± 2%        1.46s ± 1%  -3.12%  (p=0.004 n=6+5)

	name     old user-time/op  new user-time/op  delta
	Build-8        11.9s ± 2%        10.8s ± 1%  -8.71%  (p=0.002 n=6+6)

While at it, only do CI builds on pushes and PRs to the master branch,
so that my PRs created from the same repo don't trigger duplicate
builds.

.github/workflows/test.yml

@@ -1,4 +1,10 @@
-on: [push, pull_request]
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
 name: Test
 jobs:
   test:

main.go

@@ -378,6 +378,11 @@ func transformCompile(args []string) ([]string, error) {
 		// Nothing to transform; probably just ["-V=full"].
 		return args, nil
 	}
+
+	// We will force the linker to drop DWARF via -w, so don't spend time
+	// generating it.
+	flags = append(flags, "-dwarf=false")
+
 	pkgPath := flagValue(flags, "-p")
 	if pkgPath == "runtime" || pkgPath == "runtime/internal/sys" {
 		// Even though these packages aren't private, we will still process
@@ -387,7 +392,7 @@ func transformCompile(args []string) ([]string, error) {
 		envGarbleLiterals = false
 		envGarbleDebugDir = ""
 	} else if !isPrivate(pkgPath) {
-		return args, nil
+		return append(flags, paths...), nil
 	}
 	for i, path := range paths {
 		if filepath.Base(path) == "_gomod_.go" {
@@ -397,7 +402,7 @@ func transformCompile(args []string) ([]string, error) {
 		}
 	}
 	if len(paths) == 1 && filepath.Base(paths[0]) == "_testmain.go" {
-		return args, nil
+		return append(flags, paths...), nil
 	}
 
 	// If the value of -trimpath doesn't contain the separator ';', the 'go
@@ -465,7 +470,6 @@ func transformCompile(args []string) ([]string, error) {
 	// shorter prefixes later in the list, such as $PWD if TMPDIR=$PWD/tmp.
 	flags = flagSetValue(flags, "-trimpath", tempDir+"=>;"+trimpath)
 	// log.Println(flags)
-	args = flags
 
 	pkgDebugDir := ""
 	if envGarbleDebugDir != "" {
@@ -477,6 +481,7 @@ func transformCompile(args []string) ([]string, error) {
 	}
 
 	// TODO: randomize the order and names of the files
+	newPaths := make([]string, 0, len(files))
 	for i, file := range files {
 		origName := filepath.Base(filepath.Clean(paths[i]))
 		name := origName
@@ -539,13 +544,10 @@ func transformCompile(args []string) ([]string, error) {
 		}
 		debugFile.Close() // this is ok to error if no file is supplied
 
-		args = append(args, tempFile.Name())
+		newPaths = append(newPaths, tempFile.Name())
 	}
 
-	// We will force the linker to drop DWARF via -w, so don't spend time
-	// generating it.
-	flags = append(flags, "-dwarf=false")
-	return args, nil
+	return append(flags, newPaths...), nil
 }
 
 // isPrivate checks if GOPRIVATE matches pkgPath.
@@ -950,7 +952,7 @@ func splitFlagsFromArgs(all []string) (flags, args []string) {
 	for i := 0; i < len(all); i++ {
 		arg := all[i]
 		if !strings.HasPrefix(arg, "-") {
-			return all[:i], all[i:]
+			return all[:i:i], all[i:]
 		}
 		if booleanFlags[arg] || strings.Contains(arg, "=") {
 			// Either "-bool" or "-name=value".