[huang195]

Summary

Docs-only PRs currently trigger every workflow: ci.yaml (Go matrix + cpex
builds + Python), build.yaml (multi-arch Docker builds) and
security-scans.yaml (CodeQL, Trivy, Hadolint) all fire on pull_request
with no paths filter, so every push to a docs branch re-runs the full fleet.
dependabot-tidy.yml was the only workflow with a filter.

This adds paths-ignore: ["**.md"] to the pull_request triggers of the two
workflows markdown cannot break:

• build.yaml (image builds) — one edge documented at the site:
  deploy/sparc-service/Dockerfile COPYs that dir's README (pyproject
  metadata), so deleting it is a docs-only change that fails the build;
  that is caught by the push run on main, not the PR.
• security-scans.yaml (CodeQL, Trivy, Hadolint, shellcheck, YAML lint,
  Bandit).

ci.yaml stays unfiltered on purpose: several tests it runs are doc-drift
checks that read .md files from the tree and fail when docs stop matching
the code — core/sessionapi's endpoints/examples tests against
docs/session-api.md, core/plugins/cpex and core/pipeline against
docs/laptop-service.md, agentop's against README.md / docs/agents/,
the Python tests against docs/script-plugin.md, and
scripts/profile-tags/guards_test.go, which scans every .md file for
retired exclude_plugin_* tags. Filtering those out would let a docs-only
PR merge green and only fail on the post-merge push run on main.

• spellcheck_action.yml keeps no filter and keeps its shape as before this
  PR: pre-commit already runs on every PR (docs included) in ci.yaml, so no
  duplicate job is added here.
• The push: branches: [main] triggers stay unfiltered — one run per merge,
  useful as a safety net; the waste was the per-push PR reruns.
• A PR mixing docs and code still runs everything (paths-ignore only skips
  when every changed file matches).

Verified main has no required status checks (required_status_checks: []),
so a filtered-out run cannot leave a PR stuck at "Expected — waiting for
status". If one of these workflows is ever added to branch protection, the
escape is the dorny/paths-filter + always-run-gate pattern — noted in a
comment at each site.

Dogfooding note: this PR changes only .yaml files, so the filter does not
match and every workflow still runs on it — right for a CI change. The first
PR to actually skip is the next docs-only one.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

Deferred (review nit, pre-existing): spellcheck_action.yml's only remaining
job is if: false, so every PR triggers a no-op workflow run. Deleting or
re-enabling it is out of scope here.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 54 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6979a15f-1cbf-4f11-bb0f-8a47b17ba30a

Commits

Reviewing files that changed from the base of the PR and between f5da182 and 60baf1e.

Files selected for processing: 2

• .github/workflows/build.yaml
• .github/workflows/security-scans.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[clawgenti]

Summary

Cutting the CI fleet on docs-only PRs is a good idea, and the build.yaml and security-scans.yaml filters are fine. The ci.yaml filter is not. The PR rests on "markdown can't break any of it", but this repo has a set of doc-drift tests that read .md files and fail when the docs stop matching the code. Those tests run inside ci.yaml, so after this change a docs-only PR that breaks one of them would merge green and only fail on the post-merge push run on main. Details inline. I also left a smaller note on the new pre-commit job, whose comment says it runs on changed files only when it actually runs on all files.

Author: huang195 (MEMBER — maintainer)
Areas reviewed: CI/GitHub Actions, YAML, Security (action pinning)
Agent/IDE config (.claude/.vscode): none
Commits: 2 commits, all signed-off: yes
CI status: pending (DCO, pre-commit, CodeQL-go, Hadolint, and the finished image builds pass; the rest is still running)

[clawgenti]

must-fix: markdown can break this workflow. Several tests that ci.yaml runs read docs from the tree on purpose and fail when the docs drift from the code:

• core/sessionapi/doc_endpoints_test.go and doc_example_test.go check docs/session-api.md against the routes in server.go (run by Go CI (core))
• core/plugins/cpex/doc_examples_test.go checks the configs documented in docs/cpex-plugin.md
• core/pipeline/session_test.go, cmd/agentop/cmd_claudecode_test.go and doctor_unread_test.go check docs/laptop-service.md (for example, every key in managedKeys must appear in the manual-uninstall steps)
• cmd/agentop/cmd_opencode_test.go checks README.md and docs/agents/opencode.md; cmd/agentop/tui/spend_drawer_test.go checks cmd/agentop/README.md against spendDrawerTwoColumnMin
• tests/test_script_sdk.py and tests/test_example_moca_sandbox.py check docs/script-plugin.md (run by Python Tests)
• scripts/profile-tags/guards_test.go scans every .md file for retired exclude_plugin_* tags

With paths-ignore: "**.md", a docs-only PR that, say, drops a key from laptop-service.md or reintroduces an exclude_plugin_ tag merges green, and the failure only shows up on the next push run on main, after the damage is done. These tests exist to catch exactly that kind of edit.

Options, roughly from simplest:

1. Keep the filter on build.yaml and security-scans.yaml (that's most of the runner time anyway) and leave ci.yaml unfiltered.
2. Use paths: with negation and re-include the pinned docs. Order matters, because a later pattern overrides an earlier one:

   paths:
     - "**"
     - "!**.md"
     - "docs/**.md"
     - "README.md"
     - "cmd/agentop/README.md"

   This is fragile, though, because every new doc-drift test needs a matching entry here, and the profile-tags guard reads all .md files.
3. Run only the cheap doc-reading packages on docs PRs (via dorny/paths-filter), skipping the matrix and cgo jobs.

Whichever option you pick, the PR description and the comment here should stop claiming that markdown can't break the build.

[clawgenti]

suggestion: the comment is inaccurate. pre-commit/action@v3.0.1 defaults extra_args to --all-files (see its action.yml), so this job runs every hook, ruff included, across the whole tree, not just the changed files. Also, spellcheck_action.yml has no paths filter, so the job runs on every PR, and code PRs now run pre-commit twice (here and in ci.yaml's Pre-commit Checks). That makes the (docs PRs) name misleading.

It's cheap (13s on this PR), so all-files is fine. Just fix the comment and name to match. Alternatively, gate it to docs-only PRs, or pass extra_args: --from-ref origin/${{ github.base_ref }} --to-ref HEAD (with fetch-depth: 0) if changed-files-only is what you meant.

[clawgenti]

Summary

Re-review of 60baf1e. Both points from my previous review are resolved. ci.yaml no longer has the paths-ignore filter, so the doc-drift tests (session-api, cpex, laptop-service, agentop, script-plugin, and the profile-tags .md guard) still run on docs-only PRs. The duplicate Pre-commit (docs PRs) job is gone too, so pre-commit runs once per PR, in ci.yaml. The PR description now explains why ci.yaml stays unfiltered. What's left is the filter on build.yaml and security-scans.yaml, and none of those jobs read markdown in a way that can fail (Trivy's scans are informational, exit-code: '0'). I have one nit inline about the sparc-service README comment. It doesn't block merging.

Author: huang195 (MEMBER — maintainer)
Areas reviewed: CI/GitHub Actions, YAML, Security (action pinning)
Agent/IDE config (.claude/.vscode): none
Commits: 3 commits, all signed-off: yes
CI status: passing (all checks green on 60baf1e; Spellcheck and CodeRabbit skipped)

[clawgenti]

nit: this edge case is better covered than the comment says. ci.yaml is unfiltered now, and its Python Tests (sparc-service) job runs pip install -e '.[dev]' in deploy/sparc-service, where pyproject.toml sets readme = "README.md" for hatchling. If that README is deleted, the editable install fails while building metadata, so the PR goes red before merge rather than only on the post-merge push run. You could reword it to something like "...still caught on the PR by ci.yaml's sparc-service job (hatchling reads it as readme)". Fine to leave as is.