From a40ab6a9b163e495e753c6da496b37b6cdc3d6be Mon Sep 17 00:00:00 2001
From: Paul Nothaft <paul@MacStudio-von-Paul.local>
Date: Tue, 30 Jun 2026 00:07:44 +0200
Subject: [PATCH] ci: required-check workflows now fire on every PR (no paths
 filter)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Branch protection on `main` + `stable` lists `upgrade-from-bootstrap`
and `fresh-install` as REQUIRED checks. The producing workflows had
`paths:` filters in their `pull_request` triggers, so they correctly
skipped on PRs that didn't touch migrations / package.json. But a
skipped workflow doesn't satisfy a required check — it leaves the
status "missing", which blocks merge on every unrelated PR.

Concretely surfaced on PR #692 (security bumps): all 12 visible checks
were green, but the merge button was blocked because the two
path-filtered workflows skipped and their required-check names never
reported.

This PR drops the `paths:` filter from both workflows so they always
fire on PRs against `main` + `stable`. Costs:
- `schema-drift` (`upgrade-from-bootstrap`): ~75 s per PR (Postgres
  service boot + migrate:safe run + schema assertion).
- `install-smoke` (`fresh-install`): ~2 min per PR (full Docker
  Compose boot + login).

Both are buying unconditional safety nets on the install + migration
paths, which is what the required-check gate is supposed to model.

Also fixes the trigger branch list while in the file: `[main, beta]`
→ `[main, stable]`, completing the post-#669 rename for these two
workflows that were missed in PR #686.

## What this does NOT fix

`GitGuardian Security Checks` is the third required check that's
currently missing on PRs — but that's a separate problem. The
GitGuardian GitHub App was installed at the user-account level
(`the-luap`) before the org transfer and didn't move with the repo.
Re-installing it on the org via the GitHub Marketplace is a UI step
the maintainer needs to do; can't be done via API.
---
 .github/workflows/install-smoke.yml | 25 +++++++++----------------
 .github/workflows/schema-drift.yml  | 21 +++++++++------------
 2 files changed, 18 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/install-smoke.yml b/.github/workflows/install-smoke.yml
index b1c655e3..78a3c282 100644
--- a/.github/workflows/install-smoke.yml
+++ b/.github/workflows/install-smoke.yml
@@ -16,24 +16,17 @@ name: Fresh-install smoke
 # don't pay the build cost.
 
 on:
+  # No `paths:` filter — branch protection on `main` + `stable` lists
+  # `fresh-install` as a REQUIRED check, and a path-filtered trigger
+  # that skipped on unrelated PRs (e.g. frontend-only) would leave the
+  # required check "missing" forever and block the merge. Better to
+  # pay the boot cost on every PR than maintain a per-path allowlist
+  # that drifts as the install surface evolves. (Branches also updated
+  # post-#669 rename: beta → main, old main → stable.)
   push:
-    branches: [main, beta]
-    paths:
-      - 'backend/Dockerfile'
-      - 'backend/wait-for-db.sh'
-      - 'backend/migrations/**'
-      - 'backend/package*.json'
-      - 'docker-compose.production.yml'
-      - '.github/workflows/install-smoke.yml'
+    branches: [main, stable]
   pull_request:
-    branches: [main, beta]
-    paths:
-      - 'backend/Dockerfile'
-      - 'backend/wait-for-db.sh'
-      - 'backend/migrations/**'
-      - 'backend/package*.json'
-      - 'docker-compose.production.yml'
-      - '.github/workflows/install-smoke.yml'
+    branches: [main, stable]
   workflow_dispatch:
 
 permissions:
diff --git a/.github/workflows/schema-drift.yml b/.github/workflows/schema-drift.yml
index 8811d77b..f9d94716 100644
--- a/.github/workflows/schema-drift.yml
+++ b/.github/workflows/schema-drift.yml
@@ -30,20 +30,17 @@ name: Schema drift (#530)
 # the same shape is caught before merge.
 
 on:
+  # No `paths:` filter — branch protection on `main` + `stable` lists
+  # `upgrade-from-bootstrap` as a REQUIRED check. A path-filtered
+  # trigger that skipped on unrelated PRs would leave the required
+  # check "missing" forever, blocking every PR that doesn't touch
+  # migrations. The ~75-second cost on every PR buys an unconditional
+  # safety net. (Branches also updated post-#669 rename: beta → main,
+  # old main → stable.)
   push:
-    branches: [main, beta]
-    paths:
-      - 'backend/migrations/**'
-      - 'backend/src/database/db.js'
-      - 'backend/knexfile.js'
-      - '.github/workflows/schema-drift.yml'
+    branches: [main, stable]
   pull_request:
-    branches: [main, beta]
-    paths:
-      - 'backend/migrations/**'
-      - 'backend/src/database/db.js'
-      - 'backend/knexfile.js'
-      - '.github/workflows/schema-drift.yml'
+    branches: [main, stable]
   workflow_dispatch:
 
 permissions: