ci: skip heavy suites on version-bump PRs via paths-ignore (PER-9560)

[AkashBrowserStack]

Summary

Automated version-bump PRs (opened by version-bump.yml) change only lerna.json + packages/*/package.json and have no code to test, yet they otherwise wait ~1h on the full Linux/Windows test matrices (PER-9560).

This skips the heavy suites on those PRs with a simple path filter — and crucially, the heavy jobs don't appear on the PR at all (the workflow doesn't run), keeping version-bump PRs clean:

on:
  pull_request:
    paths-ignore:
      - 'lerna.json'
      - 'packages/*/package.json'

A PR whose diff is confined to those files won't trigger test.yml / windows.yml. Any PR touching source (or yarn.lock) still runs the full suite, so this doubles as a correct "only skip when there's nothing to test" filter. These checks aren't required by branch protection, so skipped PRs aren't left pending. lint, typecheck, Semgrep, and CodeQL are untouched and keep running on every PR.

Replaces the earlier approach

This reverts the job-level skip + version_only gate from #2284 (removes the changes job, the version_only / github-actions[bot] conditions, and the permissions block) in favour of the path filter — far less machinery, and it hides the jobs instead of showing them as skipped/green.

Verified end-to-end (on a fork of percy/cli)

PR	Changed files	Result
version-only	lerna.json + packages/cli/package.json	only Lint + Typecheck ran — Test and Windows did not run ✅
source	a file under packages/core/src/	Lint, Typecheck, Test, Windows all ran ✅

Test plan

• A version-bump PR (only lerna.json + packages/*/package.json) shows no Build/Test/Regression checks; lint/typecheck/Semgrep/CodeQL still run; PR is mergeable.
• A PR touching any source file (or yarn.lock) runs the full Linux + Windows matrices.
• Push to master / workflow_dispatch unaffected.

🤖 Generated with Claude Code

[AkashBrowserStack]

🤖 Claude Code Review — stack:pr-review

PR: #2293 • Head: 3292fdb • Reviewers: stack:percy-cli-code-reviewer (harness percy-cli stack) + inline 18-row checklist

Summary: Skips the heavy Linux/Windows test matrices on automated version-bump PRs via on.pull_request.paths-ignore: [lerna.json, packages/*/package.json] on test.yml/windows.yml, so version-only PRs don't trigger those workflows (no Build/Test/Regression checks appear). Reverts #2284's changes job / version_only gate / permissions block. Any PR touching source (or yarn.lock) still runs the full suite.

Priority	Category	Check	Status	Notes
High	Security	No hardcoded secrets / credentials	✅ Pass	Only pre-existing secrets.PERCY_REGRESSION_TOKEN (untouched, masked)
High	Security	Authn/authz checks present	N/A	Workflow config
High	Security	Input validation / sanitization	✅ Pass	No new untrusted-input usage; removed gh api code used safe env: interpolation
High	Security	No IDOR	N/A	No resource access
High	Security	No SQL injection	N/A	No SQL
High	Correctness	Logic correct, edge cases handled	✅ Pass	paths-ignore skips only when EVERY changed file matches → no false-skip; source/yarn.lock always run; push unaffected
High	Correctness	Explicit error handling	N/A	No runtime error paths in this diff
High	Correctness	No race/concurrency issues	N/A	None
Medium	Testing	New code has tests	N/A	CI config — validated end-to-end on a fork (version-only PR → Test/Windows didn't run; source PR → full suite ran)
Medium	Testing	Error/edge paths tested	✅ Pass	Fork run covered skip + run paths
Medium	Testing	Existing tests still pass	✅ Pass	No test logic changed
Medium	Performance	No N+1 / unbounded fetch	N/A	—
Medium	Performance	Long tasks backgrounded	N/A	—
Medium	Quality	Follows codebase patterns	✅ Pass	Standard GitHub Actions path filter; valid YAML
Medium	Quality	Focused (single concern)	✅ Pass	Two workflow files only
Low	Quality	Meaningful names, no dead code	✅ Pass	Removes dead skip machinery
Low	Quality	Comments explain why	✅ Pass	Comments removed per request; filter is self-evident
Low	Quality	No unnecessary deps	✅ Pass	Drops the third-party action used by #2284

Findings: No Critical/High findings. Two non-blocking (Low) notes: (1) the filter's packages/*/package.json is narrower than version-bump.yml's add-paths: packages/**/package.json, but harmless (no nested manifests are tracked; mismatch fails safe → full suite runs). (2) Removing the permissions: block restores the repo default token scope; adding an explicit permissions: contents: read would keep least-privilege as defense-in-depth — optional.

---

Verdict: PASS