From 4cf2319b8a30c6e7c5808d9cc408fc70638f0453 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 14 Jun 2026 02:17:35 +0100
Subject: [PATCH] ## What Fix a required-status-check deadlock by converting
 the path-filtered required job to a **pass-through shim** (same pattern as
 echidna#256).
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why
This job is a **required** status check but its workflow is path-filtered on `pull_request`, so it never runs (never reports) on PRs that don't touch those paths — branch protection then waits forever and the PR can't merge via normal flow.

## Fix
- Drop the `pull_request` paths-filter so the job **always runs** (the required check always reports).
- A `Detect relevant changes` step reads the PR's changed files via the GitHub API and gates the heavy steps — real work runs only when the relevant sources change; otherwise it passes through in seconds.
- `push` stays scoped to the default branch + paths (post-merge behaviour unchanged); job names preserved so the required contexts still match.

Identified by the 2026-06-14 estate required-check deadlock audit (`dev-notes/audits/`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 .github/workflows/echidna-validation.yml | 34 +++++++++++++++++++++---
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/echidna-validation.yml b/.github/workflows/echidna-validation.yml
index 67efb20..89aca2b 100644
--- a/.github/workflows/echidna-validation.yml
+++ b/.github/workflows/echidna-validation.yml
@@ -3,20 +3,21 @@
 name: ECHIDNA Validation
 on:
   push:
+    branches: [main]   # only post-merge; feature-branch PRs are gated by the pull_request run below
     paths:
       - 'services/*/src/**'
       - 'cli/**'
       - 'opsm_ex/native/**'
       - '.github/workflows/echidna-validation.yml'
+  # No pull_request paths-filter: ECHIDNA Safety Audit is a REQUIRED status check,
+  # so it must report on every PR (a path-filtered required check deadlocks PRs that
+  # don't touch its paths). The "Detect relevant changes" step gates the heavy work.
   pull_request:
-    paths:
-      - 'services/**'
-      - 'cli/**'
-      - 'opsm_ex/native/**'
   schedule:
     - cron: '0 6 * * 1' # Weekly on Monday at 06:00 UTC
 permissions:
   contents: read
+  pull-requests: read   # change-detector reads the PR's file list (gh api pulls/.../files)
 jobs:
   echidna-audit:
     name: ECHIDNA Safety Audit
@@ -25,13 +26,35 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      # Required-check shim: only audited Rust sources need the real audit. The
+      # workflow file itself is NOT in the pattern so CI-only edits pass through.
+      - name: Detect relevant changes
+        id: detect
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          PATTERN='^(services/|cli/|opsm_ex/native/)'
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            FILES=$(gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --paginate --jq '.[].filename')
+            if printf '%s\n' "$FILES" | grep -qE "$PATTERN"; then
+              echo "relevant=true" >> "$GITHUB_OUTPUT"; echo "Audited sources changed — running full audit."
+            else
+              echo "relevant=false" >> "$GITHUB_OUTPUT"; echo "No audited-source changes — pass-through (required-check shim)."
+            fi
+          else
+            echo "relevant=true" >> "$GITHUB_OUTPUT"
+          fi
       - name: Install Rust toolchain
+        if: steps.detect.outputs.relevant == 'true'
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
         with:
           components: clippy
       - name: Cache Rust dependencies
+        if: steps.detect.outputs.relevant == 'true'
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
       - name: Unsafe audit
+        if: steps.detect.outputs.relevant == 'true'
         run: |
           echo "=== Unsafe Code Audit ==="
           UNSAFE_COUNT=0
@@ -48,6 +71,7 @@ jobs:
           echo "Total unsafe without SAFETY comment: $UNSAFE_COUNT"
           echo "unsafe_count=$UNSAFE_COUNT" >> $GITHUB_OUTPUT
       - name: Dangerous pattern scan
+        if: steps.detect.outputs.relevant == 'true'
         run: |
           echo "=== Dangerous Pattern Scan ==="
           ISSUES=0
@@ -64,6 +88,7 @@ jobs:
             echo "WARNING: Dangerous patterns detected — review required"
           fi
       - name: Clippy strict analysis
+        if: steps.detect.outputs.relevant == 'true'
         run: |
           for dir in services/*/; do
             if [ -f "$dir/Cargo.toml" ]; then
@@ -74,6 +99,7 @@ jobs:
             fi
           done
       - name: Summary
+        if: steps.detect.outputs.relevant == 'true'
         run: |
           echo "## ECHIDNA Validation Results" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY