fix(ci): correctly skip code CI for docs-only PRs

[theCyberTech]

Summary

dorny/paths-filter was configured with exclusion-only patterns (!docs/**, !**/*.md) and no positive include. Under the default some quantifier, a bare negation matches every path that is not in the excluded set — so docs-only PRs still got code=true and ran the full test/typecheck/lint matrix.

Changes

• tests / type-checker / linter: add '**' include and predicate-quantifier: every so a file must match all patterns (everything except docs and markdown).
• vulnerability-scan: add the same path filter on pull_request; schedule and push to main still always run pip-audit.

Expected behavior

PR changes	code	tests / typecheck / lint / pip-audit
Only docs/** or *.md	false	skipped
Any other code path	true	runs
Schedule / push to main (vuln scan)	true	runs

  

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6afdd0a1-46ac-425f-95b7-23c2c203de7c

📥 Commits

Reviewing files that changed from the base of the PR and between b10c4ff and fc771b6.

📒 Files selected for processing (4)

• .github/workflows/linter.yml
• .github/workflows/tests.yml
• .github/workflows/type-checker.yml
• .github/workflows/vulnerability-scan.yml

---

📝 Walkthrough

Walkthrough

Changes

The workflows now classify documentation-only and Markdown-only changes as non-code changes. Linting, tests, and type checking use stricter path filters. Vulnerability scanning detects code changes and conditionally runs pip-audit.

Changes

Workflow change detection

Layer / File(s)	Summary
Standardize code path filters .github/workflows/linter.yml, .github/workflows/tests.yml, .github/workflows/type-checker.yml	The workflows include all files, require every path-filter pattern to match, and exclude docs/** and Markdown files from the code filter.
Gate vulnerability scanning .github/workflows/vulnerability-scan.yml	The workflow adds a changes job that emits a code-change output for pull requests. The pip-audit job depends on this output and runs only when code changes are detected.

Suggested reviewers: greysonlalonde, lucasgomide

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the CI change that skips code checks for documentation-only pull requests.
Description check	✅ Passed	The description accurately explains the path-filter changes and the expected CI behavior for documentation-only pull requests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/fix-docs-only-ci-skip-252b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Ready to approve

The change is narrowly scoped to workflow filtering and uses predicate-quantifier: every + ** consistently to fix the verified exclusion-only matching behavior.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR fixes CI change detection so docs-only / markdown-only pull requests don’t incorrectly trigger the full code CI matrix, by correcting how dorny/paths-filter patterns are evaluated.

Changes:

• Update tests, type-checker, and linter workflows to add an explicit ** include and set predicate-quantifier: every so exclusion patterns behave as intended for docs-only PRs.
• Gate vulnerability-scan’s pip-audit job on the same “code changed” detection for pull_request, while keeping push to main and schedule runs always enabled.

File summaries

File	Description
.github/workflows/tests.yml	Ensures docs-only/markdown-only PRs set code=false so the test matrix is skipped correctly.
.github/workflows/type-checker.yml	Applies the same corrected paths-filter logic to skip mypy for docs-only/markdown-only PRs.
.github/workflows/linter.yml	Applies the same corrected paths-filter logic to skip lint for docs-only/markdown-only PRs.
.github/workflows/vulnerability-scan.yml	Adds change detection and gates pip-audit on PRs while preserving scheduled/push-to-main scans.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.