Looks like I had the logic a little off. Changes needs to be a condition within each if statement, not by itself.

.gitlab-ci.yml

@@ -85,16 +85,17 @@ test_build:
     - earthly --use-inline-cache +unit-tests-linux --BASE=container $project_args
   resource_group: test
   rules:
-    - if: $CI_COMMIT_MESSAGE =~ /\[ci dryrun]/
-      when: never
-    - if: $IS_NIGHTLY == "true"
-      when: never
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_PIPELINE_SOURCE == "push"
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-    - changes:
+      changes:
         - veilid-*/**
         - '**/*[Cc]argo*'
+      when: always
+    - if: $CI_PIPELINE_SOURCE == "push"
+      changes:
+        - veilid-*/**
+        - '**/*[Cc]argo*'
+      when: always
+    - when: never
 
 semgrep:
   # A Docker image with Semgrep installed.