ci: use path-based skip instead of paths-ignore for required checks

The repo has a ruleset requiring these checks: Build, Typecheck,
Test: core, Test: engine, Test: runtime contract, regression.
With paths-ignore, docs-only PRs would never report these checks,
blocking merge forever.

Fix: add a `changes` job using dorny/paths-filter that detects
whether code files changed. Each job uses `if: needs.changes.outputs.code == 'true'`
which causes GitHub to report the job as "skipped" (counts as passing)
rather than "never started" (counts as pending).

The regression summary job explicitly handles the no-code-changes case
by checking the filter output before evaluating shard results.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -2,24 +2,41 @@ name: CI
 
 on:
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-      - "DOCS_GUIDELINES.md"
   push:
     branches: [main]
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-      - "DOCS_GUIDELINES.md"
 
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            code:
+              - "packages/**"
+              - "scripts/**"
+              - "package.json"
+              - "pnpm-lock.yaml"
+              - "pnpm-workspace.yaml"
+              - "tsconfig*.json"
+              - "Dockerfile*"
+              - ".github/workflows/ci.yml"
+              - ".github/workflows/regression.yml"
+
   build:
     name: Build
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -36,6 +53,8 @@ jobs:
 
   typecheck:
     name: Typecheck
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -53,6 +72,8 @@ jobs:
 
   test-core:
     name: "Test: core"
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -69,6 +90,8 @@ jobs:
 
   test-engine:
     name: "Test: engine"
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -85,6 +108,8 @@ jobs:
 
   test-runtime-contract:
     name: "Test: runtime contract"
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:

.github/workflows/regression.yml

@@ -2,20 +2,33 @@ name: regression
 
 on:
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-      - "DOCS_GUIDELINES.md"
   push:
     branches:
       - main
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-      - "DOCS_GUIDELINES.md"
 
 jobs:
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            code:
+              - "packages/**"
+              - "scripts/**"
+              - "Dockerfile*"
+              - "pnpm-lock.yaml"
+              - ".github/workflows/regression.yml"
+
   regression-shards:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 40
     strategy:
@@ -91,11 +104,15 @@ jobs:
   # Summary job — matches the required check name in branch protection
   regression:
     runs-on: ubuntu-latest
-    needs: regression-shards
+    needs: [changes, regression-shards]
     if: always()
     steps:
-      - name: Check shard results
+      - name: Check results
         run: |
+          if [ "${{ needs.changes.outputs.code }}" != "true" ]; then
+            echo "No code changes — skipping regression (auto-pass)"
+            exit 0
+          fi
           if [ "${{ needs.regression-shards.result }}" != "success" ]; then
             echo "One or more regression shards failed"
             exit 1