ci: scope generation validation to generation-affecting files only

.github/workflows/generate-command.yml

@@ -54,6 +54,10 @@ name: Generate SDK
                 description: Validate generation without creating a PR
                 type: boolean
                 default: false
+            should_run:
+                description: Whether the generate job should run (false = skip). Used by callers to pass path-filter results so the job skips internally and reports as 'skipped' (satisfying required checks).
+                type: boolean
+                default: true
         outputs:
             has_changes:
                 description: Whether the generation produced changes vs committed code
@@ -69,6 +73,7 @@ concurrency:
 jobs:
     generate:
         name: Generate SDK
+        if: ${{ inputs.should_run != false }}
         runs-on: ubuntu-latest
         timeout-minutes: 30
         outputs:

.github/workflows/test-full.yml

@@ -15,6 +15,12 @@
 # workflow that never runs as "expected" (pending), which blocks required checks.
 # Instead, we filter paths at the job level so skipped jobs report as "skipped"
 # (equivalent to "passed" for required checks).
+#
+# The path filter is scoped to generation-affecting files only (Speakeasy config,
+# gen.yaml, overlays, scripts, src/, etc.). Dev dependency updates (mypy, pylint,
+# etc.) skip the generation validation because they don't change generated
+# artifacts, and Dependabot PRs lack the SPEAKEASY_API_KEY secret needed to run
+# the generation pipeline.
 
 name: Test (Full)
 
@@ -39,19 +45,26 @@ jobs:
         with:
           filters: |
             generation:
-              - '**'
-              - '!README.md'
-              - '!docs/**'
+              - '.speakeasy/**'
+              - '.genignore'
+              - '.github/speakeasy/**'
+              - '.github/workflows/generate-command.yml'
+              - 'gen.yaml'
+              - 'overlays/**'
+              - 'README.md'
+              - 'scripts/**'
+              - 'poe_tasks.toml'
+              - 'src/**'
     outputs:
       should_run: ${{ github.event_name == 'workflow_dispatch' || steps.filter.outputs.generation == 'true' }}
 
   validate:
     name: Validate Generation (Dry Run)
     needs: check-paths
-    if: needs.check-paths.outputs.should_run == 'true'
     uses: ./.github/workflows/generate-command.yml
     with:
       dry_run: true
+      should_run: ${{ needs.check-paths.outputs.should_run == 'true' }}
     secrets: inherit
 
   zero-diff: