From 61d842ba29d901c5d323b9385f6fe56da89ee473 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Thu, 15 Oct 2026 00:44:45 -0600
Subject: [PATCH] fix(ci): run go jobs when embedded assets change

The changes job's go filter was an allowlist of 12 entries. PRs touching Go compile inputs outside it skipped all Go CI while ci-success passed:

- go:embed targets: providers/*/provider.yaml, hack/pro/provider.yaml, pkg/inject/inject.sh, pkg/dockerfile/test_Dockerfile
- testdata read by tests: cmd/workspace/up/testdata, pkg/secrets/testdata
- test input read via relative path: sites/docs-devsy-sh/public/install.sh (hack/install_script)
- build config: .golangci.yaml, .golangci-version, Taskfile.yml, mise.toml, mise.lock

Replace the allowlist with directory-level entries for cmd, pkg, providers, hack, e2e, plus **/testdata/**. Positive globs only; no negation. Docs, desktop and most of sites/ still do not trigger Go CI.
---
 .github/workflows/pr-ci.yml | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index de918b1568..0f7b29d7eb 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -25,18 +25,31 @@ jobs:
         with:
           filters: |
             go:
+              # Go sources and root entry point.
               - '**/*.go'
+              - 'main.go'
+              # Go trees. Directory-level so embeds (providers/*/provider.yaml,
+              # pkg/inject/inject.sh, pkg/dockerfile/test_Dockerfile) and test
+              # fixtures are covered without enumerating files.
+              - 'cmd/**'
+              - 'pkg/**'
+              - 'providers/**'
+              - 'hack/**'
+              - 'e2e/**'
+              - '**/testdata/**'
+              # Non-Go file read by hack/install_script/install_test.go.
+              - 'sites/docs-devsy-sh/public/install.sh'
+              # Module, toolchain, lint, and build config.
               - 'go.mod'
               - 'go.sum'
+              - 'mise.toml'
+              - 'mise.lock'
+              - '.golangci.yaml'
+              - '.golangci-version'
               - '.goreleaser.yml'
-              - 'e2e/**'
-              - 'hack/microsandbox/**'
-              - 'hack/provider_update_ci/**'
-              - 'hack/run-managed-policy-e2e.sh'
-              - '.github/workflows/pr-ci.yml'
-              - 'hack/licenses/**'
-              - 'hack/podman_ci/**'
+              - 'Taskfile.yml'
               - 'THIRD_PARTY_LICENSES.md'
+              - '.github/workflows/pr-ci.yml'
 
   precommit:
     name: Pre-commit