From f185faeaf56858faf91c39cd45c891a91ef5986f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mete=20Fatih=20C=C4=B1r=C4=B1t?= <mfc@autoware.org>
Date: Mon, 20 Apr 2026 13:40:52 +0300
Subject: [PATCH] ci(health-check-pr): always run, gate work via changed-files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Required status checks were blocked when the workflow's `paths:` filter
excluded a PR: the check never appeared, so branch protection waited
forever. Drop `paths:` and gate `require-label` (and transitively
`health-check`) on `step-security/changed-files`. Skipped jobs satisfy
required checks; missing workflows do not.

Signed-off-by: Mete Fatih Cırıt <mfc@autoware.org>
---
 .github/workflows/health-check-pr.yaml | 31 +++++++++++++++++++-------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/health-check-pr.yaml b/.github/workflows/health-check-pr.yaml
index 2cbe6eec9b..36f9b9c991 100644
--- a/.github/workflows/health-check-pr.yaml
+++ b/.github/workflows/health-check-pr.yaml
@@ -7,21 +7,36 @@ on:
       - synchronize
       - reopened
       - labeled
-    paths:
-      - repositories/*.repos
-      - .github/workflows/health-check.yaml
-      - .github/workflows/health-check-pr.yaml
-      - .github/workflows/health-check-reusable.yaml
-      - ansible-galaxy-requirements.yaml
-      - ansible/**
-      - docker-new/**
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
+  changed-files:
+    runs-on: ubuntu-latest
+    outputs:
+      should-run: ${{ steps.check.outputs.any_changed }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - id: check
+        uses: step-security/changed-files@v47
+        with:
+          files: |
+            repositories/*.repos
+            .github/workflows/health-check.yaml
+            .github/workflows/health-check-pr.yaml
+            .github/workflows/health-check-reusable.yaml
+            ansible-galaxy-requirements.yaml
+            ansible/**
+            docker-new/**
+
   require-label:
+    needs: changed-files
+    if: needs.changed-files.outputs.should-run == 'true'
     uses: autowarefoundation/autoware-github-actions/.github/workflows/require-label.yaml@v1
     with:
       label: run:health-check