Scope workflow path cascade to per-reusable filters

Previously a single `workflows` filter matched any change under
`.github/workflows/**` or `.github/actions/**` and cascaded into every
per-job gate, so editing pr.yml or any reusable triggered the full
CI suite (rust integration tests, unit tests, type check, ...) even
for additive changes. Wasted minutes; harder to review which checks
actually mattered.

Split the cascade:
- `actions:` keeps the global fan-out (composite actions are shared
  infrastructure; any change can affect anything).
- `workflows_<job>:` filters cascade only to their own reusable.
- `pr.yml` no longer cascades; it's pure routing and its own gating
  determines what runs.

Also drop the now-unused `workflows` boolean input from lint.yml,
and the stale comment block in lint.yml's claude_plugin_validate
job.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 2 people

.github/workflows/lint.yml

@@ -39,10 +39,6 @@ on:
         description: Validate the Claude plugin marketplace and plugin manifests
         type: boolean
         default: false
-      workflows:
-        description: Reserved for orchestrator-wide gating
-        type: boolean
-        default: false
   workflow_dispatch:
     inputs:
       rust:
@@ -72,9 +68,6 @@ on:
       claude_plugin:
         type: boolean
         default: true
-      workflows:
-        type: boolean
-        default: true
 
 permissions:
   contents: read
@@ -236,10 +229,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      # The `claude` CLI is distributed as an npm package. The Brewfile cask
-      # `claude-code@latest` is macOS-only, so install via npm on the Linux
-      # runner. Pinned exact so a validator change cannot silently flip a
-      # previously-green PR red.
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:

.github/workflows/pr.yml

@@ -26,21 +26,29 @@ jobs:
       api: ${{ steps.filter.outputs.api }}
       embedding: ${{ steps.filter.outputs.embedding }}
       docker: ${{ steps.filter.outputs.docker }}
-      workflows: ${{ steps.filter.outputs.workflows }}
+      actions: ${{ steps.filter.outputs.actions }}
+      workflows_lint: ${{ steps.filter.outputs.workflows_lint }}
+      workflows_type_check: ${{ steps.filter.outputs.workflows_type_check }}
+      workflows_unit_test: ${{ steps.filter.outputs.workflows_unit_test }}
+      workflows_integration_test: ${{ steps.filter.outputs.workflows_integration_test }}
+      workflows_security_audit: ${{ steps.filter.outputs.workflows_security_audit }}
+      workflows_lhci: ${{ steps.filter.outputs.workflows_lhci }}
+      workflows_docker_build: ${{ steps.filter.outputs.workflows_docker_build }}
+      workflows_e2e_test: ${{ steps.filter.outputs.workflows_e2e_test }}
       terraform: ${{ steps.filter.outputs.terraform }}
       shell: ${{ steps.filter.outputs.shell }}
       markdown: ${{ steps.filter.outputs.markdown }}
       openapi: ${{ steps.filter.outputs.openapi }}
       astro: ${{ steps.filter.outputs.astro }}
       claude_plugin: ${{ steps.filter.outputs.claude_plugin }}
-      lint_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.shell == 'true' || steps.filter.outputs.markdown == 'true' || steps.filter.outputs.terraform == 'true' || steps.filter.outputs.astro == 'true' || steps.filter.outputs.openapi == 'true' || steps.filter.outputs.claude_plugin == 'true' || steps.filter.outputs.workflows == 'true' }}
-      type_check_needed: ${{ steps.filter.outputs.ts == 'true' || steps.filter.outputs.workflows == 'true' }}
-      unit_test_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.shell == 'true' || steps.filter.outputs.workflows == 'true' }}
-      integration_test_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.workflows == 'true' }}
-      security_audit_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true' || steps.filter.outputs.workflows == 'true' }}
-      lhci_needed: ${{ steps.filter.outputs.landing == 'true' || steps.filter.outputs.workflows == 'true' }}
-      docker_build_needed: ${{ (steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true') && github.event.pull_request.head.repo.full_name == github.repository }}
-      e2e_test_needed: ${{ (steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true') && github.event.pull_request.head.repo.full_name == github.repository }}
+      lint_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.shell == 'true' || steps.filter.outputs.markdown == 'true' || steps.filter.outputs.terraform == 'true' || steps.filter.outputs.astro == 'true' || steps.filter.outputs.openapi == 'true' || steps.filter.outputs.claude_plugin == 'true' || steps.filter.outputs.actions == 'true' || steps.filter.outputs.workflows_lint == 'true' }}
+      type_check_needed: ${{ steps.filter.outputs.ts == 'true' || steps.filter.outputs.actions == 'true' || steps.filter.outputs.workflows_type_check == 'true' }}
+      unit_test_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.shell == 'true' || steps.filter.outputs.actions == 'true' || steps.filter.outputs.workflows_unit_test == 'true' }}
+      integration_test_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.actions == 'true' || steps.filter.outputs.workflows_integration_test == 'true' }}
+      security_audit_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true' || steps.filter.outputs.actions == 'true' || steps.filter.outputs.workflows_security_audit == 'true' }}
+      lhci_needed: ${{ steps.filter.outputs.landing == 'true' || steps.filter.outputs.actions == 'true' || steps.filter.outputs.workflows_lhci == 'true' }}
+      docker_build_needed: ${{ (steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true' || steps.filter.outputs.actions == 'true' || steps.filter.outputs.workflows_docker_build == 'true') && github.event.pull_request.head.repo.full_name == github.repository }}
+      e2e_test_needed: ${{ (steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true' || steps.filter.outputs.actions == 'true' || steps.filter.outputs.workflows_e2e_test == 'true') && github.event.pull_request.head.repo.full_name == github.repository }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
@@ -83,9 +91,24 @@ jobs:
               - 'docker-compose.yml'
               - 'apps/*/Dockerfile'
               - 'infra/docker/**/!(*.md|*.mdx)'
-            workflows:
-              - '.github/workflows/**/!(*.md|*.mdx)'
+            actions:
               - '.github/actions/**/!(*.md|*.mdx)'
+            workflows_lint:
+              - '.github/workflows/lint.yml'
+            workflows_type_check:
+              - '.github/workflows/type_check.yml'
+            workflows_unit_test:
+              - '.github/workflows/unit_test.yml'
+            workflows_integration_test:
+              - '.github/workflows/integration_test.yml'
+            workflows_security_audit:
+              - '.github/workflows/security_audit.yml'
+            workflows_lhci:
+              - '.github/workflows/lhci.yml'
+            workflows_docker_build:
+              - '.github/workflows/docker_build.yml'
+            workflows_e2e_test:
+              - '.github/workflows/e2e_test.yml'
             terraform:
               - 'terraform/**'
               - '**/*.tf'
@@ -109,51 +132,50 @@ jobs:
     if: needs.prepare.outputs.lint_needed == 'true'
     uses: ./.github/workflows/lint.yml
     with:
-      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      shell: ${{ needs.prepare.outputs.shell == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      markdown: ${{ needs.prepare.outputs.markdown == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      terraform: ${{ needs.prepare.outputs.terraform == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      astro: ${{ needs.prepare.outputs.astro == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      openapi: ${{ needs.prepare.outputs.openapi == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      claude_plugin: ${{ needs.prepare.outputs.claude_plugin == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      workflows: ${{ needs.prepare.outputs.workflows == 'true' }}
+      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_lint == 'true' }}
+      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_lint == 'true' }}
+      shell: ${{ needs.prepare.outputs.shell == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_lint == 'true' }}
+      markdown: ${{ needs.prepare.outputs.markdown == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_lint == 'true' }}
+      terraform: ${{ needs.prepare.outputs.terraform == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_lint == 'true' }}
+      astro: ${{ needs.prepare.outputs.astro == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_lint == 'true' }}
+      openapi: ${{ needs.prepare.outputs.openapi == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_lint == 'true' }}
+      claude_plugin: ${{ needs.prepare.outputs.claude_plugin == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_lint == 'true' }}
     secrets: inherit
 
   type_check:
     needs: prepare
     if: needs.prepare.outputs.type_check_needed == 'true'
     uses: ./.github/workflows/type_check.yml
     with:
-      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }}
+      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_type_check == 'true' }}
     secrets: inherit
 
   unit_test:
     needs: prepare
     if: needs.prepare.outputs.unit_test_needed == 'true'
     uses: ./.github/workflows/unit_test.yml
     with:
-      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      shell: ${{ needs.prepare.outputs.shell == 'true' || needs.prepare.outputs.workflows == 'true' }}
+      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_unit_test == 'true' }}
+      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_unit_test == 'true' }}
+      shell: ${{ needs.prepare.outputs.shell == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_unit_test == 'true' }}
     secrets: inherit
 
   integration_test:
     needs: prepare
     if: needs.prepare.outputs.integration_test_needed == 'true'
     uses: ./.github/workflows/integration_test.yml
     with:
-      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }}
+      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_integration_test == 'true' }}
     secrets: inherit
 
   security_audit:
     needs: prepare
     if: needs.prepare.outputs.security_audit_needed == 'true'
     uses: ./.github/workflows/security_audit.yml
     with:
-      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }}
-      docker: ${{ needs.prepare.outputs.docker == 'true' || needs.prepare.outputs.workflows == 'true' }}
+      rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_security_audit == 'true' }}
+      ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_security_audit == 'true' }}
+      docker: ${{ needs.prepare.outputs.docker == 'true' || needs.prepare.outputs.actions == 'true' || needs.prepare.outputs.workflows_security_audit == 'true' }}
     secrets: inherit
 
   lhci: