fix(ci): skip docs-only changes for Dependency Review, OSV Scanner

[seonghobae]

What

Adds paths-ignore: ["docs/**", "*.md"] to the pull_request trigger of .github/workflows/dependency-review.yml and .github/workflows/osvscanner.yml.

Why

An org-wide audit of ContextualWisdomLab repos found workflow files lacking paths-ignore, causing full CI (dependency review, OSV scanning) to run on every PR/push including docs-only changes. This needlessly triggers jobs and contributes to org-wide GitHub Actions queue congestion ("대적" — a backlog of queued runs that keeps growing instead of shrinking) under the org's shared 60-concurrent-job plan ceiling.

Safety verification performed

• Live-checked branch protection (branches/develop/protection) and both active rulesets on develop.
• Neither edited file's job/check name ("Dependency Review" / job osv-scan) appears in the classic required status check contexts (unit-and-api, cloud-e2e, Analyze (javascript-typescript), Analyze (python), property fuzz), so a docs-only PR that now skips these workflows will not starve a required check.
• Neither file is referenced by the org's CWL Central required workflows ruleset (id 18156473), which only pins workflows sourced from the central .github repo.
• Neither file already had a paths-ignore/paths filter (audit-safe list confirmed live, not stale).
• Both files only have pull_request and workflow_dispatch triggers (no push trigger exists in either), so paths-ignore was added only under pull_request per the fix scope.
• YAML validated with python3 -c "import yaml; yaml.safe_load(open(...))" after editing.

No behavior change for code-touching PRs; docs/markdown-only PRs will simply no longer trigger these two workflows.

🤖 Generated with Claude Code

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 9 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: c7577182-2fca-46fc-82f0-893d4e958370

📥 Commits

Reviewing files that changed from the base of the PR and between 2c32887 and ff76530.

📒 Files selected for processing (2)

• .github/workflows/dependency-review.yml
• .github/workflows/osvscanner.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 Nested Markdown changes still launch scans

Markdown-only PRs under .jules or .agents still launch both scans because *.md matches only repository-root files.

Prompt for agents

Update the Markdown path-ignore pattern in both .github/workflows/dependency-review.yml and .github/workflows/osvscanner.yml so it matches Markdown files at any repository depth, including root files and nested files under .jules and .agents. Preserve the docs/** exclusion and verify the resulting GitHub Actions path-filter semantics for both root and nested Markdown-only pull requests.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Superseded by #663, which removes both central duplicates and applies the complete trigger-aware concurrency contract.