Improve CI path filtering (#3696)

.github/workflows/codeql.yml

@@ -1,6 +1,39 @@
 name: "CodeQL Code Scanning"
 
-on: [push, pull_request, workflow_dispatch]
+on:
+  push:
+    # NOTE: `!` doesn't work with `paths-ignore` :(
+    # So we a catch-all glob instead
+    # https://github.com/orgs/community/discussions/25369#discussioncomment-3247674
+    paths:
+      - "**"
+      - "!.github/**"
+      - ".github/workflows/codeql.yml"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
+  pull_request:
+    # See above
+    paths:
+      - "**"
+      - "!.github/**"
+      - ".github/workflows/codeql.yml"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
+  workflow_dispatch:
 
 jobs:
   CodeQL:

.github/workflows/flatpak.yml

@@ -2,22 +2,38 @@ name: Flatpak
 
 on:
   push:
-    paths-ignore:
-      - "**.md"
-      - "**/LICENSE"
-      - ".github/ISSUE_TEMPLATE/**"
-      - ".markdownlint**"
-      - "nix/**"
     # We don't do anything with these artifacts on releases. They go to Flathub
     tags-ignore:
       - "*"
+    # NOTE: `!` doesn't work with `paths-ignore` :(
+    # So we a catch-all glob instead
+    # https://github.com/orgs/community/discussions/25369#discussioncomment-3247674
+    paths:
+      - "**"
+      - "!.github/**"
+      - ".github/workflows/flatpak.yml"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
   pull_request:
-    paths-ignore:
+    # See above
-      - "**.md"
+    paths:
-      - "**/LICENSE"
+      - "**"
-      - ".github/ISSUE_TEMPLATE/**"
+      - "!.github/**"
-      - ".markdownlint**"
+      - ".github/workflows/flatpak.yml"
-      - "nix/**"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
   workflow_dispatch:
 
 permissions:

.github/workflows/nix.yml

@@ -4,28 +4,34 @@ on:
   push:
     tags:
       - "*"
-    paths-ignore:
+    # NOTE: `!` doesn't work with `paths-ignore` :(
-      - ".github/**"
+    # So we a catch-all glob instead
-      - "!.github/workflows/nix.yml"
+    # https://github.com/orgs/community/discussions/25369#discussioncomment-3247674
-      - "flatpak/"
+    paths:
-      - "scripts/"
+      - "**"
+      - "!.github/**"
+      - ".github/workflows/nix.yml"
+      - "!flatpak/"
+      - "!scripts/"
 
-      - ".git*"
+      - "!.git*"
-      - ".envrc"
+      - "!.envrc"
-      - "**.md"
+      - "!**.md"
-      - "!COPYING.md"
+      - "COPYING.md"
-      - "renovate.json"
+      - "!renovate.json"
   pull_request_target:
-    paths-ignore:
+    paths:
-      - ".github/**"
+      - "**"
-      - "flatpak/"
+      - "!.github/**"
-      - "scripts/"
+      - ".github/workflows/nix.yml"
+      - "!flatpak/"
+      - "!scripts/"
 
-      - ".git*"
+      - "!.git*"
-      - ".envrc"
+      - "!.envrc"
-      - "**.md"
+      - "!**.md"
-      - "!COPYING.md"
+      - "COPYING.md"
-      - "renovate.json"
+      - "!renovate.json"
   workflow_dispatch:
 
 permissions:

.github/workflows/trigger_builds.yml

@@ -4,21 +4,39 @@ on:
   push:
     branches-ignore:
       - "renovate/**"
-    paths-ignore:
+    # NOTE: `!` doesn't work with `paths-ignore` :(
-      - "**.md"
+    # So we a catch-all glob instead
-      - "**/LICENSE"
+    # https://github.com/orgs/community/discussions/25369#discussioncomment-3247674
-      - "flake.lock"
+    paths:
-      - "packages/**"
+      - "**"
-      - ".github/ISSUE_TEMPLATE/**"
+      - "!.github/**"
-      - ".markdownlint**"
+      - ".github/workflows/build.yml"
+      - ".github/workflows/trigger_builds.yml"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
   pull_request:
-    paths-ignore:
+    # See above
-      - "**.md"
+    paths:
-      - "**/LICENSE"
+      - "**"
-      - "flake.lock"
+      - "!.github/**"
-      - "packages/**"
+      - ".github/workflows/build.yml"
-      - ".github/ISSUE_TEMPLATE/**"
+      - ".github/workflows/trigger_builds.yml"
-      - ".markdownlint**"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
   workflow_dispatch:
 
 jobs: