From 2483b6c8459d3161945418b5ca89f017bb961c2b Mon Sep 17 00:00:00 2001
From: "Michael A. Smith" <michael@opencoreemr.com>
Date: Thu, 14 May 2026 10:41:16 -0400
Subject: [PATCH] ci: drop pull_request.paths for required-check safety

GitHub never creates a check run when on.pull_request.paths excludes a
PR, so workflows pinned as required checks would never report and
auto-merge would stall. Strip pull_request.paths from this repo's own
actionlint self-trigger and from every "Recommended caller stanza"
documented in the reusables (actionlint, hadolint, dclint,
php-composer-script) so consumers copy the safe pattern.

push.paths is unchanged - post-merge re-runs on main still benefit
from filtering, and post-merge runs are not required checks.

See ocemr-docs reference/github-actions.md "Required Checks and
paths: Filters" for the full rationale.

Refs openCoreEMR/toolbox#24
Assisted-by: Claude Code
---
 .github/workflows/actionlint.yml          | 10 +++-------
 .github/workflows/dclint.yml              | 10 +++-------
 .github/workflows/hadolint.yml            |  7 +++----
 .github/workflows/php-composer-script.yml | 20 ++++++++------------
 4 files changed, 17 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 3d1c12b..eff0e7e 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -1,6 +1,8 @@
 # actionlint reusable workflow.
 #
-# Recommended caller stanza:
+# Recommended caller stanza. Do not add `paths:` to `pull_request`; it
+# breaks promotion to a required check (skipped run = missing check =
+# auto-merge stall). Path filtering on `push` is fine.
 #
 #   name: actionlint
 #   on:
@@ -11,9 +13,6 @@
 #         - .github/actions/**
 #     pull_request:
 #       branches: [main]
-#       paths:
-#         - .github/workflows/**
-#         - .github/actions/**
 #   jobs:
 #     actionlint:
 #       uses: openCoreEMR/github-workflows-public/.github/workflows/actionlint.yml@<tag>
@@ -31,9 +30,6 @@ on:
   pull_request:
     branches:
       - main
-    paths:
-      - .github/workflows/**
-      - .github/actions/**
   workflow_call:
     inputs:
       runs-on:
diff --git a/.github/workflows/dclint.yml b/.github/workflows/dclint.yml
index 7823a39..162e9e4 100644
--- a/.github/workflows/dclint.yml
+++ b/.github/workflows/dclint.yml
@@ -1,6 +1,8 @@
 # dclint (Docker Compose linter) reusable workflow.
 #
-# Recommended caller stanza:
+# Recommended caller stanza. Do not add `paths:` to `pull_request`; it
+# breaks promotion to a required check (skipped run = missing check =
+# auto-merge stall). Path filtering on `push` is fine.
 #
 #   name: dclint
 #   on:
@@ -14,12 +16,6 @@
 #         - .github/workflows/dclint.yml
 #     pull_request:
 #       branches: [main]
-#       paths:
-#         - '**/compose.yml'
-#         - '**/compose.yaml'
-#         - '**/docker-compose*.yml'
-#         - '**/docker-compose*.yaml'
-#         - .github/workflows/dclint.yml
 #   jobs:
 #     dclint:
 #       uses: openCoreEMR/github-workflows-public/.github/workflows/dclint.yml@<tag>
diff --git a/.github/workflows/hadolint.yml b/.github/workflows/hadolint.yml
index e0e1cfc..2f6406a 100644
--- a/.github/workflows/hadolint.yml
+++ b/.github/workflows/hadolint.yml
@@ -1,6 +1,8 @@
 # hadolint (Dockerfile linter) reusable workflow.
 #
-# Recommended caller stanza:
+# Recommended caller stanza. Do not add `paths:` to `pull_request`; it
+# breaks promotion to a required check (skipped run = missing check =
+# auto-merge stall). Path filtering on `push` is fine.
 #
 #   name: hadolint
 #   on:
@@ -11,9 +13,6 @@
 #         - .github/workflows/hadolint.yml
 #     pull_request:
 #       branches: [main]
-#       paths:
-#         - '**/Dockerfile*'
-#         - .github/workflows/hadolint.yml
 #   jobs:
 #     hadolint:
 #       uses: openCoreEMR/github-workflows-public/.github/workflows/hadolint.yml@<tag>
diff --git a/.github/workflows/php-composer-script.yml b/.github/workflows/php-composer-script.yml
index d02e4e8..26ad6dd 100644
--- a/.github/workflows/php-composer-script.yml
+++ b/.github/workflows/php-composer-script.yml
@@ -1,7 +1,10 @@
 # Generic reusable for any "composer install + composer <script>" job
 # (phpstan, phpcs, rector, composer-validate, composer-normalize,
 # composer-require-checker, php-syntax-check, etc.). The caller should
-# scope the trigger to relevant paths so the job only runs when needed.
+# scope the `push` trigger to relevant paths so post-merge runs on
+# `main` only fire when needed. Do NOT add `paths:` to `pull_request`;
+# it breaks promotion to a required check (skipped run = missing check
+# = auto-merge stall).
 #
 # Recommended caller stanza (PHPStan):
 #
@@ -19,14 +22,6 @@
 #         - .github/workflows/phpstan.yml
 #     pull_request:
 #       branches: [main]
-#       paths:
-#         - '**.php'
-#         - phpstan.neon
-#         - phpstan.neon.dist
-#         - phpstan-baseline.neon
-#         - composer.json
-#         - composer.lock
-#         - .github/workflows/phpstan.yml
 #   jobs:
 #     phpstan:
 #       uses: openCoreEMR/github-workflows-public/.github/workflows/php-composer-script.yml@<tag>
@@ -36,9 +31,10 @@
 #         name: Run PHPStan
 #         run: composer phpstan
 #
-# Recommended path filters by script. Always include composer.json (and
-# composer.lock for anything that runs `composer install`) since each job
-# is invoked through a composer script that's defined there:
+# Recommended `push.paths` filters by script. Always include
+# composer.json (and composer.lock for anything that runs
+# `composer install`) since each job is invoked through a composer
+# script that's defined there:
 #
 #   composer-validate          composer.json
 #   composer-normalize         composer.json