ci: better filter workflow runs

Signed-off-by: Seth Flynn <getchoo@tuta.io>

.github/workflows/codeql.yml

@@ -1,6 +1,39 @@
 name: "CodeQL Code Scanning"
 
-on: [push, pull_request, workflow_dispatch]
+on:
+  push:
+    # NOTE: `!` doesn't work with `paths-ignore` :(
+    # So we a catch-all glob instead
+    # https://github.com/orgs/community/discussions/25369#discussioncomment-3247674
+    paths:
+      - "**"
+      - "!.github/**"
+      - ".github/workflows/codeql.yml"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
+  pull_request:
+    # See above
+    paths:
+      - "**"
+      - "!.github/**"
+      - ".github/workflows/codeql.yml"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
+  workflow_dispatch:
 
 jobs:
   CodeQL:

.github/workflows/trigger_builds.yml

@@ -4,21 +4,39 @@ on:
   push:
     branches-ignore:
       - "renovate/**"
-    paths-ignore:
+    # NOTE: `!` doesn't work with `paths-ignore` :(
-      - "**.md"
+    # So we a catch-all glob instead
-      - "**/LICENSE"
+    # https://github.com/orgs/community/discussions/25369#discussioncomment-3247674
-      - "flake.lock"
+    paths:
-      - "packages/**"
+      - "**"
-      - ".github/ISSUE_TEMPLATE/**"
+      - "!.github/**"
-      - ".markdownlint**"
+      - ".github/workflows/build.yml"
+      - ".github/workflows/trigger_builds.yml"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
   pull_request:
-    paths-ignore:
+    # See above
-      - "**.md"
+    paths:
-      - "**/LICENSE"
+      - "**"
-      - "flake.lock"
+      - "!.github/**"
-      - "packages/**"
+      - ".github/workflows/build.yml"
-      - ".github/ISSUE_TEMPLATE/**"
+      - ".github/workflows/trigger_builds.yml"
-      - ".markdownlint**"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
   workflow_dispatch:
 
 jobs: