chore: skip full CI for secrets baseline commits

[lucarlig]

🔗 Related Issue

Closes #4953

---

📝 Summary

Adds a shared CI decision script for secrets-baseline-only latest commits. Full CI is skipped only when the latest commit modifies only .secrets.baseline and the parent commit already has a successful run for the same workflow and event.

The PR workflows that fired in validation now gate their heavy jobs on that decision. Pre-commit still runs detect-secrets validation on the fast path, while Tests & Coverage, Rust CI, Build Python Package, and Vitest skip their heavy jobs after a completed parent run.

---

🏷️ Type of Change

• Bug fix
• Feature / Enhancement
• Documentation
• Refactor
• Chore (deps, CI, tooling)
• Other (describe below)

---

🧪 Verification

Check	Command	Status
Decision unit tests	uv run pytest tests/unit/test_secret_baseline_ci_decision_workflow.py -q	Pass
Workflow YAML parse	ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f) }; puts "yaml ok"' .github/workflows/*.yml	Pass
Workflow lint	actionlint -shellcheck= .github/workflows/*.yml	Pass
Diff whitespace	git diff --check origin/main	Pass
Secrets validation	make --no-print-directory detect-secrets-hook	Pass
Local Actions PR decision	act pull_request -W .github/workflows/pre-commit.yml -j ci-decision ...	Pass
GitHub test 1	Baseline-only commit with incomplete parent ran full PR CI	Pass
GitHub test 2	Baseline-only commit with completed parent skipped heavy PR jobs and ran detect-secrets	Pass
Commit hooks	git commit -s	Pass

---

✅ Checklist

• Code formatted (make black isort pre-commit)
• Tests added/updated for changes
• Documentation updated (if applicable)
• No secrets or credentials committed

---

📓 Notes (optional)

The secrets-detection-only allowlist is intentionally narrow: one modified .secrets.baseline file.

---

GitHub CI validation proof

Dummy PRs were opened with do-not-merge, used only to validate this CI behavior, then closed after verification:

• Pre-commit Checks: DUMMY DO NOT MERGE: Pre-commit Checks baseline CI validation #5048
  • First .secrets.baseline-only commit ran the target workflow because the parent commit had no completed CI.
  • Second .secrets.baseline-only commit passed and ran only make --no-print-directory detect-secrets-hook.
• Tests & Coverage: DUMMY DO NOT MERGE: Tests & Coverage baseline CI validation #5049
  • First .secrets.baseline-only commit ran full pytest.
  • Second .secrets.baseline-only commit skipped pytest after the CI decision job passed.
• Build Python Package: DUMMY DO NOT MERGE: Build Python Package baseline CI validation #5050
  • First .secrets.baseline-only commit ran the package build.
  • Second .secrets.baseline-only commit skipped build-package after the CI decision job passed.
• JavaScript Tests (Vitest): DUMMY DO NOT MERGE: JavaScript Tests (Vitest) baseline CI validation #5051
  • First .secrets.baseline-only commit ran Vitest.
  • Second .secrets.baseline-only commit skipped Vitest after the CI decision job passed.
• Rust CI: DUMMY DO NOT MERGE: Rust CI baseline CI validation #5052
  • First .secrets.baseline-only commit ran full Rust CI.
  • Second .secrets.baseline-only commit skipped Rust heavy jobs after the CI decision job passed.

[madhu-mohan-jaishankar]

LGTM

[brian-hussey]

LGTM.