← Back to issue list

ci: skip QA and Spread workflows for security-scanner-only PRs

View original Github issue

Metadata

Project
craft-application
Number
#1131
Type
pull request
State
merged
Author
Copilot
Labels
—
Created
Updated
Closed

Current evaluation

Merged in canonical/craft-application#1131 (commit d8885203), adding paths-ignore filters so QA and Spread workflows skip security-scanner-only PRs; test follow-up #1132 was closed as unnecessary.

Resolution: closed resolved

Reason: PR #1131 was merged and added paths-ignore filters to qa.yaml and spread.yaml for security-scanner-only changes. The resolving commit is d8885203; follow-up testing PR #1132 was closed as no longer relevant.

Evaluated by: mr-cal-bot

No scores available.

Issue body

PRs that only touch `.github/workflows/policy.yaml` or `.osv-scanner.toml` unnecessarily trigger the full QA and Spread CI pipelines. ## Changes - **`qa.yaml`** — adds `paths-ignore` on `pull_request` trigger to skip when only the security scanner workflow or OSV config is changed - **`spread.yaml`** — same, skips spread builds for security-scanner-only PRs The `policy.yaml` workflow (which contains the `python-scans` security scanner job) retains no path filters, so it always runs on PRs including those that only touch these files. Tested working at https://github.com/canonical/craft-application/pull/1132

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged in canonical/craft-application#1131 (commit d8885203), adding paths-ignore filters so QA and Spread workflows skip security-scanner-only PRs; test follow-up #1132 was closed as unnecessary.
stealth/space-bunny-alpha — closed resolved Merged in commit d8885203, adding path filters to qa.yaml and spread.yaml so security-scanner-only PRs skip unnecessary CI pipelines.
stealth/space-bunny-alpha — closed resolved Merged PR #1131 via commit d8885203, adding paths-ignore filters so QA and Spread skip PRs limited to policy.yaml or .osv-scanner.toml; follow-up PR #1132 was closed.
stealth/space-bunny-alpha — closed resolved PR #1131 merged (commit d8885203), adding paths-ignore for .github/workflows/policy.yaml and .osv-scanner.toml to the pull_request triggers in qa.yaml and spread.yaml; follow-up test PR #1132 closed as unnecessary.
stealth/space-bunny-alpha — closed resolved Merged canonical/craft-application#1131 after two approvals, adding paths-ignore filters to qa.yaml and spread.yaml for security-scanner-only PRs; follow-up testing PR #1132 was closed.
qwen/qwen3.6-35b-a3b — — Merged. Added paths-ignore filters to qa.yaml and spread.yaml to skip QA and Spread CI pipelines for PRs only modifying security scanner configurations. Approved by two reviewers and successfully merged.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 10
Confidence: 95
needs review Adds paths-ignore to qa.yaml and spread.yaml to skip CI workflows when only security scanner configs change. PR has two approvals, passing CI, and zero unresolved comments.
qwen3.6-35b-a3b-mtp-q6
Staleness: 15
Complexity: 10
Confidence: 95
close stale Skips QA and Spread CI workflows for security-scanner-only changes. Author superseded this PR with #1132 for further testing and review.

Update history

Date Change
updated

Related work

  • Related To: canonical/craft-application#1132 (confidence 98%)

    Testing follow-up opened to exercise the filters and closed unmerged as no longer relevant after #1131 landed.

Related issues

Issue Project State Summary Similarity
#1132 [WIP] ci: skip QA and Spread workflows for security-scanner-only PRs craft-application closed Draft follow-up PR #1132, opened only to test the paths-ignore change in parent PR #1131, was closed unmerged by mr-cal on 2026-09-10 as 'no longer relevant' once #1131 landed (commit d8885203).
87%
#2688 ci: make workflows conditional on affected files charmcraft merged PR #2688 merged as commit a32937a6: added paths-ignore conditions so QA/Test, Check policy, Experimental, Tests and Spread workflows only run on affected files; Split Spread into 'Spread tests for source' and docs.
73%
#1924 ci: add security scan workflow charmcraft merged Merged #1924 in commit 5634ecb1, adding the CI security-scan workflow after syncing canonical/craft-archives#128; two reviewers approved it.
72%
#160 ci: add path filter to qa workflow, make jobs conditional debcraft merged Merged in fa39c6f, adding QA path filtering and making Starflow lint/test jobs conditional so docs-only changes can skip them (CRAFT-5161).
71%
#1205 ci: make workflows conditional, add docs-only spread tests rockcraft closed Superseded by merged PR canonical/rockcraft#1206 (commit 3624f64c), which implemented conditional CI and split source and docs Spread tests.
71%
#128 ci: add security scan workflow craft-archives merged Merged security-scan workflow in canonical/craft-archives#128 via commit 70b7abb, adding automated security scanning to CI.
71%
#427 ci: Add missing permissions to QA lint workflow craft-store closed PR #427 (lengau) added job-level contents/pull-requests read permissions to craft-store's QA lint job (+3/-0). All CI checks passed but review stayed pending; closed unmerged in favour of workflow-level fix PR #428.
70%
#6256 ci: add path filter to qa workflow, make jobs conditional snapcraft merged PR #6256 (CRAFT-5161) merged as commit 9a7074ce8, adding dorny/paths-filter to .github/workflows/qa.yaml, gating lint/test jobs on a paths filter and forwarding filters to Starflow workflows.
70%
#418 ci: fix security scan workflow imagecraft merged Merged PR #418 (commit f7059bc) fixed zizmor CI by granting the policy job security-events: write, mirroring canonical/craft-archives#245. Dependencies were unchanged.
70%