From e9c8f5831c0eddfa065e13a624b7f939f1f451e9 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Mon, 18 May 2026 07:32:24 -0500
Subject: [PATCH 1/2] feat(ci): add path-based filtering and gate job to
 pr-ci.yml

Add dorny/paths-filter to skip e2e tests when no Go source files
change. The build-cli, integration-tests-unprivileged, and
integration-tests jobs now only run when Go-related paths are modified.
A ci-success gate job always runs and reports overall status, failing
only if a required job failed (not if skipped).
---
 .github/workflows/pr-ci.yml | 54 ++++++++++++++++++++++++++++++++++---
 1 file changed, 51 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index 73f3c43de..b0fac0bc0 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -7,6 +7,26 @@ on:
   pull_request:
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      go: ${{ steps.filter.outputs.go }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            go:
+              - '**/*.go'
+              - 'go.mod'
+              - 'go.sum'
+              - '.goreleaser.yml'
+              - 'e2e/**'
+              - '.github/workflows/pr-ci.yml'
+
   precommit:
     name: Pre-commit
     runs-on: ubuntu-latest
@@ -49,7 +69,8 @@ jobs:
 
   build-cli:
     name: Build CLI Binary on ${{ matrix.runner }}
-    needs: [precommit, lint]
+    needs: [changes, precommit, lint]
+    if: needs.changes.outputs.go == 'true'
     strategy:
       matrix:
         include:
@@ -89,7 +110,8 @@ jobs:
 
   integration-tests-unprivileged:
     name: Test ${{ matrix.label }} on ${{ matrix.runner }}
-    needs: [build-cli]
+    needs: [changes, build-cli]
+    if: needs.changes.outputs.go == 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -155,7 +177,8 @@ jobs:
 
   integration-tests:
     name: Test ${{ matrix.label }}${{ matrix.install-podman && format(' ({0})', matrix.install-podman) || '' }} on ${{ matrix.runner }}
-    needs: [can-read-secret, build-cli]
+    needs: [changes, can-read-secret, build-cli]
+    if: needs.changes.outputs.go == 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -562,3 +585,28 @@ jobs:
       - name: verify docker is installed
         if: matrix.label == 'docker-install' && (matrix.requires-secret == false || needs.can-read-secret.outputs.secret-set == 'true')
         run: docker --version && docker ps
+
+  ci-success:
+    name: CI Success
+    runs-on: ubuntu-latest
+    if: always()
+    needs:
+      - changes
+      - precommit
+      - lint
+      - build-cli
+      - integration-tests-unprivileged
+      - integration-tests
+    steps:
+      - name: Check required jobs
+        run: |
+          # Fail if any required job failed (not skipped)
+          if [[ "${{ needs.precommit.result }}" == "failure" ]] || \
+             [[ "${{ needs.lint.result }}" == "failure" ]] || \
+             [[ "${{ needs.build-cli.result }}" == "failure" ]] || \
+             [[ "${{ needs.integration-tests-unprivileged.result }}" == "failure" ]] || \
+             [[ "${{ needs.integration-tests.result }}" == "failure" ]]; then
+            echo "One or more required jobs failed"
+            exit 1
+          fi
+          echo "All required jobs passed or were skipped"

From 27d433932c302cf39ba4f3eb36f92c29f09352b0 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Mon, 18 May 2026 07:37:51 -0500
Subject: [PATCH 2/2] fix(ci): address code review findings for path-filter

- Add contents: read permission so actions/checkout works on push/
  workflow_dispatch events
- Check needs.changes.result in gate job to catch changes job failures
- Use actions/checkout@v6 for consistency with rest of workflow
---
 .github/workflows/pr-ci.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index b0fac0bc0..a9f1a317f 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -10,11 +10,12 @@ jobs:
   changes:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
     outputs:
       go: ${{ steps.filter.outputs.go }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dorny/paths-filter@v3
         id: filter
         with:
@@ -601,7 +602,8 @@ jobs:
       - name: Check required jobs
         run: |
           # Fail if any required job failed (not skipped)
-          if [[ "${{ needs.precommit.result }}" == "failure" ]] || \
+          if [[ "${{ needs.changes.result }}" == "failure" ]] || \
+             [[ "${{ needs.precommit.result }}" == "failure" ]] || \
              [[ "${{ needs.lint.result }}" == "failure" ]] || \
              [[ "${{ needs.build-cli.result }}" == "failure" ]] || \
              [[ "${{ needs.integration-tests-unprivileged.result }}" == "failure" ]] || \