ci: stop spending the build pipeline on documentation-only changes

.config/mise/tasks/github-actions/archive-storage-contract → .config/mise/tasks/github/actions/archive-storage-contract

@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 xunit_project="$root/src/EventStore.Core.XUnit.Tests/EventStore.Core.XUnit.Tests.csproj"
 core_project="$root/src/EventStore.Core.Tests/EventStore.Core.Tests.csproj"
 phase=${1:?archive storage phase is required}

.config/mise/tasks/github/actions/changed-scope

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+#MISE description="Write whether the change set reaches past the documentation site to GITHUB_OUTPUT"
+
+set -euo pipefail
+
+: "${GITHUB_OUTPUT:?GITHUB_OUTPUT is required}"
+: "${EVENT_NAME:?EVENT_NAME is required}"
+
+# Kept in step with the paths release-please excludes from the server release.
+documentation_paths=('docs/')
+
+emit() {
+	printf 'code=%s\n' "$1" >>"$GITHUB_OUTPUT"
+	echo "code=$1"
+	exit 0
+}
+
+if [ "$EVENT_NAME" != "pull_request" ] && [ "$EVENT_NAME" != "merge_group" ]; then
+	echo "Event '$EVENT_NAME' always exercises the full pipeline."
+	emit true
+fi
+
+: "${BASE_REF:?BASE_REF is required}"
+head_ref="${HEAD_REF:-HEAD}"
+
+if [[ "$BASE_REF" =~ ^0+$ ]]; then
+	echo "The base ref is unresolved."
+	emit true
+fi
+
+comparison_base="$BASE_REF"
+if merge_base="$(git merge-base "$BASE_REF" "$head_ref" 2>/dev/null)"; then
+	comparison_base="$merge_base"
+fi
+
+if ! changed_files="$(git diff --name-only --no-renames "$comparison_base" "$head_ref")"; then
+	echo "The change set could not be resolved."
+	emit true
+fi
+
+if [ -z "$changed_files" ]; then
+	echo "The change set is empty."
+	emit true
+fi
+
+while IFS= read -r file; do
+	for prefix in "${documentation_paths[@]}"; do
+		if [[ "$file" == "$prefix"* ]]; then
+			continue 2
+		fi
+	done
+	echo "Change outside the documentation site: $file"
+	emit true
+done <<<"$changed_files"
+
+echo "Documentation-only change set."
+emit false

.config/mise/tasks/github-actions/client-compatibility → .config/mise/tasks/github/actions/client-compatibility

@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 phase=${1:?client compatibility phase is required}
 config="$root/.github/compatibility/clients.json"
 

.config/mise/tasks/github-actions/container → .config/mise/tasks/github/actions/container

@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 phase=${1:?container phase is required}
 
 cd "$root"

.config/mise/tasks/github-actions/docker-compose-smoke → .config/mise/tasks/github/actions/docker-compose-smoke

@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 fingerprints_before=$(mktemp)
 fingerprints_after=$(mktemp)
 compose_started=0

.config/mise/tasks/github-actions/dotnet-build → .config/mise/tasks/github/actions/dotnet-build

@@ -3,7 +3,7 @@
 
 set -euo pipefail
 
-root=$(cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 phase=${1:?dotnet build phase is required}
 
 case "$phase" in

.config/mise/tasks/github/actions/require-successful-jobs

@@ -0,0 +1,29 @@
+#!/bin/sh
+#MISE description="Fail unless every gated job reached the result the change scope calls for"
+
+set -eu
+
+: "${REQUIRED_JOBS:?REQUIRED_JOBS is required}"
+
+expected=skipped
+if [ "$(printf '%s' "$REQUIRED_JOBS" | jq -r '.changes.outputs.code')" = "true" ]; then
+	expected=success
+fi
+
+deviations="$(printf '%s' "$REQUIRED_JOBS" | jq -r --arg expected "$expected" '
+	to_entries
+	| map(select(
+		(.key == "changes" and .value.result != "success")
+		or (.key != "changes" and .value.result != $expected)
+	))
+	| .[]
+	| "\(.key): \(.value.result)"
+')"
+
+if [ -n "$deviations" ]; then
+	echo "Jobs did not reach '$expected':" >&2
+	echo "$deviations" >&2
+	exit 1
+fi
+
+echo "Every gated job reached '$expected'."

.config/mise/tasks/github-actions/vulnerability-scan → .config/mise/tasks/github/actions/vulnerability-scan

@@ -3,7 +3,7 @@
 
 set -eu
 
-root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/../../../../.." && pwd)
 results=$(mktemp)
 trap 'rm -f "$results"' EXIT HUP INT TERM
 

.github/workflows/build-container-reusable.yml

@@ -82,7 +82,7 @@ jobs:
             nuget_auth_token=${{ secrets.GITHUB_TOKEN }}
       - name: Verify Build
         if: ${{ inputs.mode != 'test-only' }}
-        run: mise run --skip-tools github-actions:container -- verify
+        run: mise run --skip-tools github:actions:container -- verify
       - name: Build Test Container
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         if: ${{ inputs.mode != 'test-only' }}
@@ -100,10 +100,10 @@ jobs:
             nuget_auth_token=${{ secrets.GITHUB_TOKEN }}
       - name: Export Test Container
         if: ${{ inputs.mode == 'build-only' }}
-        run: mise run --skip-tools github-actions:container -- export-test
+        run: mise run --skip-tools github:actions:container -- export-test
       - name: Export Container
         if: ${{ inputs.mode == 'build-only' }}
-        run: mise run --skip-tools github-actions:container -- export-runtime
+        run: mise run --skip-tools github:actions:container -- export-runtime
       - name: Publish Test Container
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ inputs.mode == 'build-only' }}
@@ -127,15 +127,15 @@ jobs:
           name: ${{ inputs.test-image-artifact-name }}
       - name: Load Test Container
         if: ${{ inputs.mode == 'test-only' }}
-        run: mise run --skip-tools github-actions:container -- load-test
+        run: mise run --skip-tools github:actions:container -- load-test
       - name: Run Tests
         if: ${{ inputs.mode != 'build-only' }}
         env:
           TEST_GROUP: ${{ inputs.test-group-name }}
-        run: mise run --skip-tools github-actions:container -- test
+        run: mise run --skip-tools github:actions:container -- test
       - name: Normalize Test Result Permissions
         if: ${{ failure() && steps.mise.outcome == 'success' }}
-        run: mise run --skip-tools github-actions:container -- normalize-results
+        run: mise run --skip-tools github:actions:container -- normalize-results
       - name: Publish Test Results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: failure()

.github/workflows/build-container-ubuntu-lts.yml

@@ -17,7 +17,13 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  changes:
+    name: Changes
+    uses: ./.github/workflows/changes-reusable.yml
+
   build-images:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     name: Build Images
     uses: ./.github/workflows/build-container-reusable.yml
     with:
@@ -30,7 +36,10 @@ jobs:
 
   test:
     name: Build (${{ matrix.test-group-name }})
-    needs: build-images
+    needs:
+      - changes
+      - build-images
+    if: ${{ needs.changes.outputs.code == 'true' }}
     strategy:
       fail-fast: true
       matrix:
@@ -58,8 +67,10 @@ jobs:
   client-compatibility:
     name: Client Compatibility
     needs:
+      - changes
       - build-images
       - test
+    if: ${{ needs.changes.outputs.code == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -86,7 +97,7 @@ jobs:
           rustup default stable
       - name: Resolve client revisions
         id: clients
-        run: mise run --skip-tools github-actions:client-compatibility -- refs
+        run: mise run --skip-tools github:actions:client-compatibility -- refs
       - name: Checkout C# client
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -106,9 +117,9 @@ jobs:
         with:
           name: eventstore-image-noble-linux-x64
       - name: Load server image
-        run: mise run --skip-tools github-actions:container -- load-runtime
+        run: mise run --skip-tools github:actions:container -- load-runtime
       - name: Run client compatibility gate
-        run: mise run --skip-tools github-actions:client-compatibility -- run
+        run: mise run --skip-tools github:actions:client-compatibility -- run
       - name: Publish compatibility evidence
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
@@ -137,13 +148,25 @@ jobs:
     name: Container CI
     if: ${{ always() }}
     needs:
+      - changes
       - build-images
       - test
       - client-compatibility
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install task runner
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.8.2
+          install: false
+          cache: false
       - name: Require successful jobs
         env:
           REQUIRED_JOBS: ${{ toJSON(needs) }}
-        run: jq -e 'all(.[]; .result == "success")' <<< "$REQUIRED_JOBS"
+        run: mise run --skip-tools github:actions:require-successful-jobs

.github/workflows/build-reusable.yml

@@ -42,26 +42,26 @@ jobs:
         env:
           NUGET_GITHUB_ACTOR: ${{ github.actor }}
           NUGET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise run --skip-tools github-actions:nuget-authenticate
+        run: mise run --skip-tools github:actions:nuget-authenticate
       - name: Compile
         env:
           BUILD_CONFIGURATION: ${{ matrix.configuration }}
           NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TARGET_ARCH: ${{ inputs.arch }}
-        run: mise run --skip-tools github-actions:dotnet-build -- compile
+        run: mise run --skip-tools github:actions:dotnet-build -- compile
       - name: Verify Build
         env:
           BUILD_CONFIGURATION: ${{ matrix.configuration }}
           TARGET_ARCH: ${{ inputs.arch }}
-        run: mise run --skip-tools github-actions:dotnet-build -- verify
+        run: mise run --skip-tools github:actions:dotnet-build -- verify
       - name: Run Tests
         env:
           BUILD_CONFIGURATION: ${{ matrix.configuration }}
           TARGET_ARCH: ${{ inputs.arch }}
-        run: mise run --skip-tools github-actions:dotnet-build -- test
+        run: mise run --skip-tools github:actions:dotnet-build -- test
       - name: Collect Test Results
         if: ${{ always() && steps.mise.outcome == 'success' }}
-        run: mise run --skip-tools github-actions:dotnet-build -- collect-results
+        run: mise run --skip-tools github:actions:dotnet-build -- collect-results
       - name: Publish Test Results (HTML)
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()

.github/workflows/build-ubuntu-lts-arm64.yml

@@ -17,7 +17,13 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  changes:
+    name: Changes
+    uses: ./.github/workflows/changes-reusable.yml
+
   build:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     name: Build
     uses: ./.github/workflows/build-reusable.yml
     with:
@@ -29,11 +35,23 @@ jobs:
     name: ARM64 CI
     if: ${{ always() }}
     needs:
+      - changes
       - build
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install task runner
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.8.2
+          install: false
+          cache: false
       - name: Require successful jobs
         env:
           REQUIRED_JOBS: ${{ toJSON(needs) }}
-        run: jq -e 'all(.[]; .result == "success")' <<< "$REQUIRED_JOBS"
+        run: mise run --skip-tools github:actions:require-successful-jobs

.github/workflows/build-ubuntu-lts-x64.yml

@@ -13,7 +13,13 @@ on:
       - v*
 
 jobs:
+  changes:
+    name: Changes
+    uses: ./.github/workflows/changes-reusable.yml
+
   build:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
     name: Build
     uses: ./.github/workflows/build-reusable.yml
     with:
@@ -25,11 +31,23 @@ jobs:
     name: X64 CI
     if: ${{ always() }}
     needs:
+      - changes
       - build
     runs-on: ubuntu-latest
-    permissions: {}
+    permissions:
+      contents: read
     steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install task runner
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.8.2
+          install: false
+          cache: false
       - name: Require successful jobs
         env:
           REQUIRED_JOBS: ${{ toJSON(needs) }}
-        run: jq -e 'all(.[]; .result == "success")' <<< "$REQUIRED_JOBS"
+        run: mise run --skip-tools github:actions:require-successful-jobs