From bea516b4846499b0a54e687c3c266b13df54c701 Mon Sep 17 00:00:00 2001
From: Rein Krul <info@reinkrul.nl>
Date: Wed, 19 Aug 2026 13:04:28 +0200
Subject: [PATCH] ci: skip govulncheck, docker build, and CodeQL (go) on
 docs-only changes

Extends the docs-only skip pattern from #4455 (test, e2e-test) to the
remaining workflows we control: govulncheck, the docker image build,
and CodeQL's own Analyze (go) job. None of these are required status
checks, but they still burn CI time/minutes on changes that can't
affect Go code or the built image.

Not touched:
- govulncheck-cron-schedule.yaml: schedule/workflow_dispatch only,
  doesn't run on PRs, so the skip doesn't apply.
- GitHub's repo-level "default setup" code scanning for Actions and
  JavaScript/TypeScript (shows up as Analyze (actions) and
  Analyze (javascript-typescript) in checks): not backed by a workflow
  file in this repo, so it can't be gated this way.

Assisted by AI
---
 .github/workflows/build-images.yaml   | 26 +++++++++++++++++++++++++
 .github/workflows/codeql-analysis.yml | 26 +++++++++++++++++++++++++
 .github/workflows/govulncheck.yaml    | 28 ++++++++++++++++++++++++++-
 3 files changed, 79 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
index 0641e95ce1..9914b90005 100644
--- a/.github/workflows/build-images.yaml
+++ b/.github/workflows/build-images.yaml
@@ -17,7 +17,33 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Docs-only changes (docs/, markdown, rst) can't affect the built image, so building/pushing one
+  # is redundant. Detected once here so the job below can skip entirely on them.
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Check for non-doc changes
+        id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: 'some-with-excludes'
+          filters: |
+            code:
+              - '**'
+              - '!docs/**'
+              - '!**/*.md'
+              - '!**/*.rst'
+
   docker:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 7f31c63d07..ab7b8ff117 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -23,8 +23,34 @@ on:
     - 'V*'
 
 jobs:
+  # Docs-only changes (docs/, markdown, rst) can't affect Go code, so CodeQL has nothing new to
+  # find. Detected once here so the job below can skip entirely on them.
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Check for non-doc changes
+        id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: 'some-with-excludes'
+          filters: |
+            code:
+              - '**'
+              - '!docs/**'
+              - '!**/*.md'
+              - '!**/*.rst'
+
   analyze:
     name: Analyze
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     permissions:
       actions: read
diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml
index e926ff7a13..62eade10af 100644
--- a/.github/workflows/govulncheck.yaml
+++ b/.github/workflows/govulncheck.yaml
@@ -16,7 +16,33 @@ on:
       - 'V*'
 
 jobs:
+  # Docs-only changes (docs/, markdown, rst) can't affect Go code, so govulncheck has nothing new
+  # to find. Detected once here so the job below can skip entirely on them.
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Check for non-doc changes
+        id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: 'some-with-excludes'
+          filters: |
+            code:
+              - '**'
+              - '!docs/**'
+              - '!**/*.md'
+              - '!**/*.rst'
+
   govulncheck_job:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     name: Run govulncheck
     steps:
@@ -24,4 +50,4 @@ jobs:
         uses: golang/govulncheck-action@v1
         with:
           go-version-input: 'stable'
-          go-package: ./...
\ No newline at end of file
+          go-package: ./...