CI: Skip the heavy workflows on docs-only PRs

.github/workflows/build.yaml

@@ -12,6 +12,14 @@
   pull_request:
     branches:
       - main
+    # Docs edits can't break an image build, so docs-only PRs skip it. One edge:
+    # deploy/sparc-service/Dockerfile COPYs that dir's README (pyproject metadata),
+    # so deleting it is a docs-only change that fails the build — caught by the
+    # push run on main, not the PR.
+    # Footgun: a filtered-out run reports "Expected" forever if this workflow is
+    # ever added to branch protection as a required check.
+    paths-ignore:
+      - "**.md"
   # Allow manual trigger
   workflow_dispatch:
 
@@ -131,7 +139,7 @@
             # Always use the computed tag
             type=raw,value=${{ steps.tag.outputs.tag }}
             # Add 'latest' tag for version tags, workflow_dispatch, and pushes to main
             type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' }}
 
       # 6b. Resolve per-image build-args.
       #   authbridge-cpex takes no CPEX FFI build-arg: its Dockerfile reads

.github/workflows/security-scans.yaml

@@ -15,6 +15,11 @@ name: Security Scans
 on:
   pull_request:
     branches: [main]
+    # Markdown cannot trip CodeQL, Trivy or Hadolint; docs-only PRs skip them.
+    # Footgun: a filtered-out run reports "Expected" forever if this workflow is
+    # ever added to branch protection as a required check.
+    paths-ignore:
+      - "**.md"
 
 permissions: {}