fix(ci): path-aware find-projects

[ksroda-sa]

Summary

Verified via test PR #160 that required status checks (without "Require workflows to succeed") block any PR that doesn't trigger every required workflow — paths-filtered workflows leave their check name in "Expected — waiting for status to be reported" forever.

This PR fixes that by:

1. Removing the paths: filter from pull_request: on every test workflow plus extract.yml. The workflows now always trigger, so the aggregator (<Framework> tests passed, validate) always reports.
2. Making find-projects path-aware in each test workflow. It computes the changed paths between the PR base and head with git diff, then emits only the project directories whose subtree was touched. Empty matrix → test/build job skipped → aggregator passes via result == 'skipped'.
3. Hardening test-js's find with -not -path "*/.angular/*" so Angular's Vite dep cache can't leak into the matrix if workflow ordering ever changes.

Behavior matrix

PR scope	test-js matrix	test-android matrix	test-ios matrix	…
Docs-only (README.md)	[] → skipped	[] → skipped	[] → skipped	all skipped → all aggregators green
samples/react/login-pkce/**	["samples/react/login-pkce"]	[] → skipped	[] → skipped	only test-js runs work
samples/android/**	[] → skipped	["samples/android/<flow>"]	[] → skipped	only test-android runs work
Workflow file itself changes	full matrix (exercises the workflow against every sample)	(others skipped unless they touched too)	…	…
Push to main / schedule / manual dispatch	full matrix (no filter, catches anything that slipped through)	full	full	safety net intact

Why this approach

GitHub's "Require status checks to pass" rule gates by check name. A workflow filtered out by paths: doesn't trigger → no check appears → required check stays "Expected" forever. The fix has to make every workflow trigger on every PR; then a cheap find-projects step decides whether there's any real work.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Switches the JS / Java / iOS / .NET / Android test workflows and extract.yml from paths:-filtered triggers to always-trigger triggers, then narrows each workflow's matrix at runtime by diffing the PR's changed files against the discovered project list. The motivation is that GitHub's required-status-checks rule waits forever on a check name produced by a workflow that paths:-filtered itself out; making every required workflow always trigger (and producing an empty matrix → skipped job → green aggregator) avoids that stuck state.

Changes:

• Drop paths: filters from pull_request (and the matching push filters) on five test-* workflows and extract.yml.
• In each test-* workflow's find-projects step, checkout with fetch-depth: 0, compute changed paths via git diff BASE..HEAD, and emit a project only if some changed file is under it; the workflow file itself acts as an "escape hatch" that re-enables the full matrix.
• Harden test-js's find with -not -path "*/.angular/*" to keep Angular's Vite dep cache out of the matrix.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/test-js.yml	Removes paths filter, adds path-aware find-projects with .angular exclude.
.github/workflows/test-java.yml	Removes paths filter, adds path-aware find-projects.
.github/workflows/test-ios.yml	Removes paths filter, adds path-aware find-projects.
.github/workflows/test-dotnet.yml	Removes paths filter, adds path-aware find-projects.
.github/workflows/test-android.yml	Removes paths filter, adds path-aware find-projects.
.github/workflows/extract.yml	Removes pull_request paths filter so validate always reports.

Comments suppressed due to low confidence (4)

.github/workflows/test-js.yml:55

• The matching uses grep -q "^${proj}/" where $proj is interpolated as a regex pattern. Project paths can legitimately contain regex metacharacters (e.g. ., +), and any future sample directory named like samples/node/express.js would have . match any character — causing both false positives (matching unrelated paths) and unanchored sub-string matches. Use a fixed-string match anchored with a leading separator, e.g. by piping CHANGED and using awk with a literal prefix check, or by escaping regex metacharacters in $proj before passing to grep. Same issue exists in test-java.yml, test-ios.yml, test-dotnet.yml, test-android.yml.

              FILTERED=$(while IFS= read -r proj; do
                [ -z "$proj" ] && continue
                if printf '%s\n' "$CHANGED" | grep -q "^${proj}/"; then
                  echo "$proj"
                fi
              done <<< "$ALL")

.github/workflows/test-js.yml:44

• git diff --name-only "$BASE_SHA" "$HEAD_SHA" 2>/dev/null || echo "" silently swallows any failure (e.g. one of the SHAs not fetched, transient git error). The result is CHANGED="", which yields an empty matrix and the test job is skipped — the aggregator then reports green even though no test ran and no error surfaced. Failing closed (running the full matrix, or failing the find step) would be safer than silently passing. Same concern applies to test-java.yml, test-ios.yml, test-dotnet.yml, and test-android.yml.

          if [ "$EVENT_NAME" = "pull_request" ]; then
            CHANGED=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" 2>/dev/null || echo "")

.github/workflows/test-js.yml:48

• The WORKFLOW_FILE "escape hatch" only triggers a full matrix when the workflow file itself changes. PRs that modify shared dependencies the workflow relies on — for example a composite action under .github/actions/**, a reusable scripts/** helper invoked by the test job, root-level config like package.json / lockfiles that affect every sample, or shared workflow includes — will not retrigger any project's matrix and the test job will be skipped. Consider broadening this trigger (e.g. include .github/actions/**, top-level config files, or any non-samples/** path that the test job consumes) or documenting the assumption that no such shared inputs exist. Same applies to all five test-*.yml files.

            # If the workflow file itself changed, run the full matrix so we
            # exercise the workflow against every sample.
            if printf '%s\n' "$CHANGED" | grep -qFx "$WORKFLOW_FILE"; then
              FILTERED="$ALL"

.github/workflows/test-js.yml:62

• The same ~20-line find-projects logic (checkout with fetch-depth: 0, env block, set -euo pipefail, find + diff + filter + jq matrix emit) is duplicated across all five test-*.yml workflows. Any fix to the regex-escaping issue, the silent-failure behavior, or the workflow-file escape hatch must be applied in five places and will drift over time. Consider extracting this into a composite action under .github/actions/find-changed-projects that takes the find pattern (and any extra excludes) as inputs and emits the matrix output. Each workflow then becomes ~5 lines.

      - id: find
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          EVENT_NAME: ${{ github.event_name }}
          WORKFLOW_FILE: .github/workflows/test-js.yml
        run: |
          set -euo pipefail
          # Exclude `.angular/cache/**/package.json` — Angular's Vite dep cache
          # writes nested package.json files inside .angular/cache after a build.
          # On a fresh CI checkout the cache doesn't exist yet, but the exclude
          # hardens us against any future ordering change that runs a build first.
          ALL=$(find samples -name "package.json" -not -path "*/node_modules/*" -not -path "*/.angular/*" -exec dirname {} \; 2>/dev/null | sort)

          if [ "$EVENT_NAME" = "pull_request" ]; then
            CHANGED=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" 2>/dev/null || echo "")
            # If the workflow file itself changed, run the full matrix so we
            # exercise the workflow against every sample.
            if printf '%s\n' "$CHANGED" | grep -qFx "$WORKFLOW_FILE"; then
              FILTERED="$ALL"
            else
              FILTERED=$(while IFS= read -r proj; do
                [ -z "$proj" ] && continue
                if printf '%s\n' "$CHANGED" | grep -q "^${proj}/"; then
                  echo "$proj"
                fi
              done <<< "$ALL")
            fi
          else
            FILTERED="$ALL"
          fi

          MATRIX=$(printf '%s\n' "$FILTERED" | jq -R -s -c 'split("\n") | map(select(. != ""))')
          echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.