ci: skip govulncheck, docker build, and CodeQL (go) on docs-only changes

.github/workflows/build-images.yaml

@@ -17,79 +17,105 @@
   cancel-in-progress: true
 
 jobs:
+  # Docs-only changes (docs/, markdown, rst) can't affect the built image, so building/pushing one
+  # is redundant. Detected once here so the job below can skip entirely on them.
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Check for non-doc changes
+        id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: 'some-with-excludes'
+          filters: |
+            code:
+              - '**'
+              - '!docs/**'
+              - '!**/*.md'
+              - '!**/*.rst'
+
   docker:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v7
 
       - name: Set version params
         id: version
         shell: bash
         run: |
           echo "git_commit=$(echo ${GITHUB_SHA})" >> $GITHUB_OUTPUT
           echo "git_branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
           echo "git_version=$(git name-rev --tags --name-only $(git rev-parse HEAD))" >> $GITHUB_OUTPUT
 
       - uses: actions-ecosystem/action-get-latest-tag@v1
         id: get-latest-tag
         with:
           semver_only: true
 
       - name: Print version params
         run: |
           echo "Commit: ${{ steps.version.outputs.git_commit }}"
           echo "Branch: ${{ steps.version.outputs.git_branch }}"
           echo "Version: ${{ steps.version.outputs.git_version }}"
           echo "Latest tag: ${{ steps.get-latest-tag.outputs.tag }}"
           echo "This tag: ${{ github.ref }}"
 
       - name: Docker meta
         id: docker_meta
         uses: docker/metadata-action@v6
         with:
           images: nutsfoundation/nuts-node
           tags: |
             # generate 'master' tag for the master branch
             type=ref,event=branch,enable={{is_default_branch}},prefix=
             # generate 5.2.1 tag
             type=semver,pattern={{version}}
           flavor: |
             latest=${{ steps.version.outputs.git_version == steps.get-latest-tag.outputs.tag }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
         if: ${{ github.event_name != 'pull_request' }}
         uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push
         uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile
           # On PRs we only verify the build doesn't break; arm64 under QEMU
           # is ~5-8x slower and adds no signal there. Multi-arch on push/tag.
           platforms: ${{ github.event_name == 'pull_request' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_meta.outputs.tags }}
           build-args: |
             GIT_VERSION=${{ steps.version.outputs.git_version }}
             GIT_COMMIT=${{ steps.version.outputs.git_commit }}
             GIT_BRANCH=${{ steps.version.outputs.git_branch }}
 
       - name: Build and push development image
         if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/master'}}
         uses: docker/build-push-action@v7
         with:
           context: development/dev-image
           push: true
           platforms: linux/amd64,linux/arm64
           tags: nutsfoundation/nuts-node:dev

.github/workflows/codeql-analysis.yml

@@ -23,8 +23,34 @@
     - 'V*'
 
 jobs:
+  # Docs-only changes (docs/, markdown, rst) can't affect Go code, so CodeQL has nothing new to
+  # find. Detected once here so the job below can skip entirely on them.
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Check for non-doc changes
+        id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: 'some-with-excludes'
+          filters: |
+            code:
+              - '**'
+              - '!docs/**'
+              - '!**/*.md'
+              - '!**/*.rst'
+
   analyze:
     name: Analyze
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     permissions:
       actions: read

.github/workflows/govulncheck.yaml

@@ -16,12 +16,38 @@
       - 'V*'
 
 jobs:
+  # Docs-only changes (docs/, markdown, rst) can't affect Go code, so govulncheck has nothing new
+  # to find. Detected once here so the job below can skip entirely on them.
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Check for non-doc changes
+        id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: 'some-with-excludes'
+          filters: |
+            code:
+              - '**'
+              - '!docs/**'
+              - '!**/*.md'
+              - '!**/*.rst'
+
   govulncheck_job:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     name: Run govulncheck
     steps:
       - id: govulncheck
         uses: golang/govulncheck-action@v1
         with:
           go-version-input: 'stable'
-          go-package: ./...
+          go-package: ./...