Skip to content

Commit 2c52bb1

Browse files
paradoxboundclaude
paradoxbound
and
claude
authored
ci: skip expensive jobs on docs-only changes (#78)
## Summary - Adds a `changes` detection job to `functional-tests.yml` and `docker-publish.yml` - `test`, `build-and-push`, and `pre-merge-cd-check` skip when only `.md` files changed - Adds `paths-ignore` to `codeql.yml` PR trigger for docs files - No version bump ## How it works The `changes` job runs `git diff` and counts files that do not match `*.md`, `LICENSE`, or `.github/ISSUE_TEMPLATE/**`. If the count is zero, it outputs `code=false`. Expensive jobs gate on `needs.changes.outputs.code == true`. When false, the jobs are **skipped** -- GitHub branch protection treats skipped as passing, so required checks are satisfied and docs-only PRs remain mergeable. ## Edge cases handled - Force push / first push / workflow_dispatch (no base SHA): always treated as code change - Mixed PR (.md + .ts): code=true, CI runs normally - Workflow file changes: code=true, CI runs ## Test plan - [ ] This PR (workflow .yml changes) runs all jobs normally - [ ] After merge: open a docs-only PR, confirm test / build-and-push / pre-merge-cd-check show as skipped (green) and PR is mergeable Generated with Claude Code Signed-off-by: Paradoxbound <paradoxbound@users.noreply.github.com> Co-authored-by: Paradoxbound <paradoxbound@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 352eabd commit 2c52bb1

3 files changed

Lines changed: 97 additions & 5 deletions

File tree

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
branches: [main]
66
pull_request:
77
branches: [main]
8+
paths-ignore:
9+
- '**/*.md'
10+
- 'LICENSE'
811
schedule:
912
# Weekly scan on Sunday at midnight UTC — catches newly published CVEs
1013
# against existing code between releases.

‎.github/workflows/docker-publish.yml‎

Lines changed: 46 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,48 @@ env:
1515

1616
jobs:
1717
# ─────────────────────────────────────────────────────────────────────────────
18-
# JOB 0 — check-version (post-merge only)
18+
# JOB 0 — changes
19+
# Detects whether any non-docs files changed. When only .md files (or
20+
# LICENSE / ISSUE_TEMPLATE) are modified, expensive jobs are skipped and
21+
# report "skipped" (green) so required branch-protection checks are satisfied.
22+
# ─────────────────────────────────────────────────────────────────────────────
23+
changes:
24+
runs-on: ubuntu-latest
25+
outputs:
26+
code: ${{ steps.filter.outputs.code }}
27+
steps:
28+
- name: Harden the runner (Audit all outbound calls)
29+
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
30+
with:
31+
egress-policy: audit
32+
33+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
34+
with:
35+
fetch-depth: 0
36+
37+
- name: Check for non-docs changes
38+
id: filter
39+
run: |
40+
if [ "${{ github.event_name }}" = "pull_request" ]; then
41+
BASE="${{ github.event.pull_request.base.sha }}"
42+
HEAD="${{ github.event.pull_request.head.sha }}"
43+
else
44+
BASE="${{ github.event.before }}"
45+
HEAD="${{ github.sha }}"
46+
fi
47+
# No base SHA (force push / first push / workflow_dispatch) → always run
48+
if [ -z "${BASE}" ] || [ "${BASE}" = "0000000000000000000000000000000000000000" ]; then
49+
echo "code=true" >> "$GITHUB_OUTPUT"
50+
echo "No base SHA — treating as code change"
51+
exit 0
52+
fi
53+
COUNT=$(git diff --name-only "${BASE}" "${HEAD}" \
54+
| grep -cvE '^(.*\.md|LICENSE(\.md)?|\.github/ISSUE_TEMPLATE/.*)$' || echo 0)
55+
echo "code=$([ "${COUNT}" -gt 0 ] && echo 'true' || echo 'false')" >> "$GITHUB_OUTPUT"
56+
echo "Non-docs changed files: ${COUNT}"
57+
58+
# ─────────────────────────────────────────────────────────────────────────────
59+
# JOB 1 — check-version (post-merge only)
1960
# Checks whether this push introduces a new version that needs releasing.
2061
# All post-merge release jobs (build push, verify, scan, merge, cleanup) are
2162
# gated on this output so that pipeline-only merges (no version bump) complete
@@ -59,9 +100,10 @@ jobs:
59100
# ─────────────────────────────────────────────────────────────────────────────
60101
build-and-push:
61102
runs-on: ubuntu-latest
62-
needs: check-version
103+
needs: [check-version, changes]
63104
if: |
64105
always() &&
106+
needs.changes.outputs.code == 'true' &&
65107
(github.event_name == 'pull_request' || needs.check-version.outputs.is-new-version == 'true')
66108
strategy:
67109
fail-fast: true
@@ -550,8 +592,9 @@ jobs:
550592
# ─────────────────────────────────────────────────────────────────────────────
551593
pre-merge-cd-check:
552594
runs-on: ubuntu-latest
553-
needs: build-and-push
595+
needs: [build-and-push, changes]
554596
if: |
597+
needs.changes.outputs.code == 'true' &&
555598
github.event_name == 'pull_request' &&
556599
github.event.pull_request.head.repo.full_name == github.repository
557600
permissions:

‎.github/workflows/functional-tests.yml‎

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,56 @@ on:
1010
permissions: read-all
1111

1212
jobs:
13+
# ─────────────────────────────────────────────────────────────────────────────
14+
# JOB 0 — changes
15+
# Detects whether any non-docs files changed. When only .md files (or
16+
# LICENSE / ISSUE_TEMPLATE) are modified, expensive jobs are skipped and
17+
# report "skipped" (green) so required branch-protection checks are satisfied.
18+
# ─────────────────────────────────────────────────────────────────────────────
19+
changes:
20+
runs-on: ubuntu-latest
21+
outputs:
22+
code: ${{ steps.filter.outputs.code }}
23+
steps:
24+
- name: Harden the runner (Audit all outbound calls)
25+
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
26+
with:
27+
egress-policy: audit
28+
29+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
with:
31+
fetch-depth: 0
32+
33+
- name: Check for non-docs changes
34+
id: filter
35+
run: |
36+
if [ "${{ github.event_name }}" = "pull_request" ]; then
37+
BASE="${{ github.event.pull_request.base.sha }}"
38+
HEAD="${{ github.event.pull_request.head.sha }}"
39+
else
40+
BASE="${{ github.event.before }}"
41+
HEAD="${{ github.sha }}"
42+
fi
43+
# No base SHA (force push / first push / workflow_dispatch) → always run
44+
if [ -z "${BASE}" ] || [ "${BASE}" = "0000000000000000000000000000000000000000" ]; then
45+
echo "code=true" >> "$GITHUB_OUTPUT"
46+
echo "No base SHA — treating as code change"
47+
exit 0
48+
fi
49+
COUNT=$(git diff --name-only "${BASE}" "${HEAD}" \
50+
| grep -cvE '^(.*\.md|LICENSE(\.md)?|\.github/ISSUE_TEMPLATE/.*)$' || echo 0)
51+
echo "code=$([ "${COUNT}" -gt 0 ] && echo 'true' || echo 'false')" >> "$GITHUB_OUTPUT"
52+
echo "Non-docs changed files: ${COUNT}"
53+
1354
test:
55+
needs: [changes]
1456
runs-on: ubuntu-latest
15-
# Secrets are not available on fork PRs — tests skip gracefully
16-
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
57+
# Skip when only docs changed. Also skip fork PRs (no secrets) — tests
58+
# skip gracefully when credentials are absent, but avoid the overhead.
59+
if: |
60+
needs.changes.outputs.code == 'true' &&
61+
(github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
62+
github.event.pull_request.head.repo.full_name == github.repository)
1763
steps:
1864
- name: Harden the runner (Audit all outbound calls)
1965
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0

0 commit comments

Comments
 (0)