ci: skip heavy test suites on bot version-bump PRs (PER-9560)

[AkashBrowserStack]

Summary

Automated version-bump PRs — opened by version-bump.yml — only touch lerna.json + packages/**/package.json and have no code impact, yet they currently block ~1h waiting on the full Linux (test.yml) and Windows (windows.yml) test matrices (PER-9560).

This skips those heavy suites for the release bot's version-bump PRs, while keeping them fully in force everywhere else.

The skip fires only when ALL THREE hold (evaluated per push):

• the head branch matches release/* (the convention set by version-bump.yml — a slash, not the release-* hyphen in the ticket),
• the PR was opened by github-actions[bot] (github.event.pull_request.user.login), and
• the PR diff is confined to version files — a changes job lists the PR's changed files (gh api .../pulls/N/files) and confirms every one is lerna.json or a top-level packages/<pkg>/package.json.

The diff check is the load-bearing one and is re-evaluated on every push, so if a source commit lands on a release/* branch after the bot opens the PR, version_only becomes false and the full suite runs — author/branch are fixed at PR-creation time and can't mask a later source change. The check is fail-safe: any API error (or a non-version file) → version_only=false → full CI runs.

What's skipped vs kept

Workflow / job	Bot release/* PR, version-only diff	Everything else
test.yml → build, test (17-pkg matrix), regression	skipped (~1h saved)	runs
windows.yml → build, test (17-pkg matrix)	skipped (~60m saved)	runs
lint, typecheck, Semgrep	run (~1m each)	run

Why a job-level if, not an on: branch filter

The test jobs are required status checks. A skipped job posts a "skipped" conclusion that satisfies branch protection, whereas an on:-level skip leaves required checks stuck "pending" and would block the release PR from ever merging.

Also adds a least-privilege permissions: block (contents: read + pull-requests: read, the latter for listing PR files).

Verified end-to-end (on a fork of percy/cli)

• Bot version-bump PR (github-actions[bot], release/1.32.0-beta.10, version-only diff) → Build/Test/Regression (Linux) and Build/Test (Windows) reported skipped; changes computed version_only=true; lint/typecheck/Semgrep ran.
• Normal PR (non-version file, human author) → changes computed version_only=false and the heavy Build/Test jobs ran.

Note: the first iteration used dorny/paths-filter with predicate-quantifier: every, which (verified on the fork) never matched — every requires a file to match all patterns at once, so version_only was always false and the skip never fired. Replaced with the explicit file-list check above.

Test plan

• Bot version-bump PR → heavy jobs skipped; lint/typecheck/Semgrep run; mergeable in ~1m.
• Push a source commit onto a release/* branch → version_only flips false → full matrices run.
• Human PR from a release/* branch → runs (author isn't the bot).
• Normal feature PR / master push / workflow_dispatch → unchanged; everything runs.

🤖 Generated with Claude Code

[pranavz28]

LGTM

[AkashBrowserStack]

🤖 Claude Code Review — stack:pr-review

PR: #2284 • Head: 6a84443 • Reviewers: stack:percy-cli-code-reviewer (harness percy-cli stack) + inline 18-row checklist

Summary: Skips the heavy Linux/Windows test matrices on automated version-bump PRs — gated per heavy job on release/* branch AND github-actions[bot] author AND a version-only diff (a changes job lists PR files and sets version_only); adds a least-privilege permissions block. CI-config-only change (two workflow files).

Priority	Category	Check	Status	Notes
High	Security	No hardcoded secrets / credentials	✅ Pass	No secrets added; pre-existing PERCY_REGRESSION_TOKEN untouched
High	Security	Authn/authz checks present	N/A	Workflow config; permissions is least-privilege (contents:read, pull-requests:read)
High	Security	Input validation / sanitization	✅ Pass	head_ref / pull_request.user.login used only in if:; PR/REPO via env: and quoted in run: — no shell injection; trigger is pull_request, not pull_request_target
High	Security	No IDOR	N/A	No resource access
High	Security	No SQL injection	N/A	No SQL
High	Correctness	Logic correct, edge cases handled	✅ Pass	Gate verified in all branches (bot version-only release → skip; later source commit → version_only flips → run; human release → run; push/dispatch → run); verified end-to-end on a fork
High	Correctness	Explicit error handling	✅ Pass	changes job fail-safe: gh api error or empty list → version_only=false → full CI
High	Correctness	No race/concurrency issues	N/A	None introduced
Medium	Testing	New code has tests	N/A	CI config — no unit tests by nature; validated end-to-end on a fork
Medium	Testing	Error/edge paths tested	✅ Pass	Fork run covered skip, run, and fail-safe paths
Medium	Testing	Existing tests still pass	✅ Pass	Only skip-gating added; non-release PRs unchanged
Medium	Performance	No N+1 / unbounded fetch	N/A	—
Medium	Performance	Long tasks backgrounded	N/A	—
Medium	Quality	Follows codebase patterns	✅ Pass	Job-level if + permissions block; matches workflow conventions
Medium	Quality	Focused (single concern)	✅ Pass	Only the two workflow files
Low	Quality	Meaningful names, no dead code	✅ Pass	version_only clearly named
Low	Quality	Comments explain why	✅ Pass	One concise comment on the version_only logic
Low	Quality	No unnecessary deps	✅ Pass	Dropped third-party dorny/paths-filter; uses gh (runner built-in)

Findings: No Fail items; no Critical/High findings. Two non-blocking (Low) notes: the changes job is duplicated across test.yml/windows.yml (keep the allow-list regex in lockstep); the regex is intentionally coupled to version-bump.yml's add-paths (fails open to running CI if they diverge).

---

Verdict: PASS