ci: skip device lanes for root-level docs-only changes (#1781 A9)

.github/workflows/android.yml

@@ -6,6 +6,12 @@ on:
       - 'docs/**'
       - 'website/**'
       - 'README.md'
+      - 'AGENTS.md'
+      - 'CHANGELOG.md'
+      - 'CONTEXT.md'
+      - 'CONTRIBUTING.md'
+      - 'LICENSE'
+      - 'SECURITY.md'
       - '.github/actions/build-docs/action.yml'
       - '.github/workflows/deploy.yml'
       - '.github/workflows/pr-preview.yml'

.github/workflows/ci.yml

@@ -6,6 +6,12 @@ on:
       - 'docs/**'
       - 'website/**'
       - 'README.md'
+      - 'AGENTS.md'
+      - 'CHANGELOG.md'
+      - 'CONTEXT.md'
+      - 'CONTRIBUTING.md'
+      - 'LICENSE'
+      - 'SECURITY.md'
       - '.github/actions/build-docs/action.yml'
       - '.github/workflows/deploy.yml'
       - '.github/workflows/pr-preview.yml'

.github/workflows/ios.yml

@@ -6,6 +6,12 @@ on:
       - 'docs/**'
       - 'website/**'
       - 'README.md'
+      - 'AGENTS.md'
+      - 'CHANGELOG.md'
+      - 'CONTEXT.md'
+      - 'CONTRIBUTING.md'
+      - 'LICENSE'
+      - 'SECURITY.md'
       - '.github/actions/build-docs/action.yml'
       - '.github/workflows/deploy.yml'
       - '.github/workflows/pr-preview.yml'

.github/workflows/linux.yml

@@ -6,6 +6,12 @@ on:
       - 'docs/**'
       - 'website/**'
       - 'README.md'
+      - 'AGENTS.md'
+      - 'CHANGELOG.md'
+      - 'CONTEXT.md'
+      - 'CONTRIBUTING.md'
+      - 'LICENSE'
+      - 'SECURITY.md'
       - '.github/actions/build-docs/action.yml'
       - '.github/workflows/deploy.yml'
       - '.github/workflows/pr-preview.yml'

.github/workflows/macos.yml

@@ -6,6 +6,12 @@ on:
       - 'docs/**'
       - 'website/**'
       - 'README.md'
+      - 'AGENTS.md'
+      - 'CHANGELOG.md'
+      - 'CONTEXT.md'
+      - 'CONTRIBUTING.md'
+      - 'LICENSE'
+      - 'SECURITY.md'
       - '.github/actions/build-docs/action.yml'
       - '.github/workflows/deploy.yml'
       - '.github/workflows/pr-preview.yml'

.github/workflows/size.yml

@@ -6,6 +6,12 @@ on:
       - 'docs/**'
       - 'website/**'
       - 'README.md'
+      - 'AGENTS.md'
+      - 'CHANGELOG.md'
+      - 'CONTEXT.md'
+      - 'CONTRIBUTING.md'
+      - 'LICENSE'
+      - 'SECURITY.md'
       - '.github/actions/build-docs/action.yml'
       - '.github/workflows/deploy.yml'
       - '.github/workflows/pr-preview.yml'

test/ci/root-docs-paths-ignore.test.ts

@@ -0,0 +1,58 @@
+// Regression pin for #1781 A9: the six root-level docs files
+// (AGENTS.md, CHANGELOG.md, CONTEXT.md, CONTRIBUTING.md, LICENSE, SECURITY.md)
+// must stay in the `pull_request` `paths-ignore` list of every workflow that
+// also ignores `docs/**`/`website/**`/`README.md` — the four device lanes plus
+// `ci.yml` and `size.yml`. Nothing else derives this: `check:gate-manifest`
+// only asks whether a *registered check* is reachable, generic Markdown
+// coverage does not look at workflow trigger config at all, and `actionlint`
+// only validates YAML shape, not policy — so a PR that quietly drops one entry
+// (e.g. re-adds `LICENSE` to a device workflow while missing it in `size.yml`)
+// would pass every other gate and put a full 9-15 min device run back on
+// prose-only PRs. This test reads the real workflow files and asserts the
+// behavior directly, via the same glob matcher the gate-manifest model uses
+// to decide whether a lane triggers for a given path.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { expect, test } from 'vitest';
+import { parse } from 'yaml';
+import { matchesGlob } from '../../scripts/gate/workflows.ts';
+
+const repoRoot = path.resolve(import.meta.dirname, '../..');
+
+const WORKFLOWS = ['ios.yml', 'android.yml', 'linux.yml', 'macos.yml', 'ci.yml', 'size.yml'];
+
+const ROOT_DOCS = [
+  'AGENTS.md',
+  'CHANGELOG.md',
+  'CONTEXT.md',
+  'CONTRIBUTING.md',
+  'LICENSE',
+  'SECURITY.md',
+];
+
+type WorkflowDoc = {
+  // A bare `on:` key can parse as the boolean key `true` under YAML 1.1
+  // semantics; scripts/gate/workflows.ts already guards against this, so this
+  // test mirrors that fallback rather than trusting `on` alone.
+  on?: Record<string, { 'paths-ignore'?: string[] }>;
+  true?: Record<string, { 'paths-ignore'?: string[] }>;
+};
+
+function pathsIgnore(file: string): string[] {
+  const doc = parse(
+    fs.readFileSync(path.join(repoRoot, '.github/workflows', file), 'utf8'),
+  ) as WorkflowDoc;
+  const on = doc.on ?? doc.true ?? {};
+  return on.pull_request?.['paths-ignore'] ?? [];
+}
+
+test.each(WORKFLOWS)('%s skips a pull_request triggered by only a root doc', (file) => {
+  const ignored = pathsIgnore(file);
+  for (const rootDoc of ROOT_DOCS) {
+    expect(
+      ignored.some((pattern) => matchesGlob(pattern, rootDoc)),
+      `${file}'s paths-ignore must match ${rootDoc} (got ${JSON.stringify(ignored)})`,
+    ).toBe(true);
+  }
+});

vitest.config.ts

@@ -86,6 +86,9 @@ export default defineConfig({
             'scripts/__tests__/package-closure-audit.test.ts',
             // Parses CI configuration only, so this action guard needs no device or subprocess lane.
             'test/ci/upload-agent-device-artifacts.test.ts',
+            // #1781 A9: pins the root-doc paths-ignore entries directly against the
+            // real workflow YAML, parse-only like its sibling above.
+            'test/ci/root-docs-paths-ignore.test.ts',
             // The frozen replay-compat corpus (#1417): parse-only, no device or
             // subprocess work, so it belongs in the fast lane next to the
             // grammar it guards.