From c7f290a86484ab69861f1dfb39b1eab70053fc0d Mon Sep 17 00:00:00 2001
From: Titus Kirch <titus.kirch@kirch.dev>
Date: Wed, 2 Sep 2026 11:59:48 +0200
Subject: [PATCH] fix(ci): pin the workflow bodies to v0.2.0 and drop
 paths-ignore

v0.2.0 ends every CI body in a stable `Gate` job, so the required status check
becomes `<caller-job> / Gate` and stops depending on a matrix value. That only
works if the workflow actually triggers: a run skipped by a path filter reports
no check at all, and a required check that never reports blocks the merge rather
than failing it.
---
 .github/workflows/ci.yml                 | 12 +++++++-----
 .github/workflows/codeql.yml             |  2 +-
 .github/workflows/fast-forward-queue.yml |  2 +-
 .github/workflows/promotion-pr.yml       |  2 +-
 .github/workflows/queue-branch.yml       |  2 +-
 .github/workflows/release-please.yml     |  4 ++--
 6 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a686b5d..049f0a6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,10 +10,12 @@ on:
       - main
       - dev
     types: [opened, synchronize, reopened, ready_for_review]
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - LICENSE
+
+# NO `paths-ignore`, AND THAT IS THE POINT OF THE GATE. A change touching only
+# prose cannot break a lint — but a workflow that does not TRIGGER reports no
+# check at all, and a required check that never reports does not pass the merge,
+# it blocks it forever. `CI / Gate` is meant to be a required check, so this
+# workflow has to run on every pull request, including a README-only one.
 
 permissions:
   contents: read
@@ -21,4 +23,4 @@ permissions:
 jobs:
   check:
     name: CI
-    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3f9c147..7e52e5c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,4 +20,4 @@ jobs:
       packages: read
       actions: read
       contents: read
-    uses: kirchDev/workflows/.github/workflows/_codeql.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_codeql.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
diff --git a/.github/workflows/fast-forward-queue.yml b/.github/workflows/fast-forward-queue.yml
index 35eafa5..d54b037 100644
--- a/.github/workflows/fast-forward-queue.yml
+++ b/.github/workflows/fast-forward-queue.yml
@@ -25,7 +25,7 @@ jobs:
       pull-requests: read
       checks: read
       statuses: read
-    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
     with:
       pr: ${{ inputs.pr }}
     secrets:
diff --git a/.github/workflows/promotion-pr.yml b/.github/workflows/promotion-pr.yml
index ebacb1e..3bb50d4 100644
--- a/.github/workflows/promotion-pr.yml
+++ b/.github/workflows/promotion-pr.yml
@@ -15,4 +15,4 @@ permissions:
 jobs:
   promotion-pr:
     name: Promotion PR
-    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
diff --git a/.github/workflows/queue-branch.yml b/.github/workflows/queue-branch.yml
index e9f199b..1af8d1f 100644
--- a/.github/workflows/queue-branch.yml
+++ b/.github/workflows/queue-branch.yml
@@ -16,6 +16,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: kirchDev/workflows/.github/workflows/_queue-branch.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_queue-branch.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
     secrets:
       BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index a11e62d..1b374e8 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -102,7 +102,7 @@ jobs:
     # `build-script` is left at its default: this repo's `build` writes the npm
     # artifact itself. coverage-report needs `build:npm` there only because its
     # `build` produces an Action bundle instead.
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
     with:
       tag-name: ${{ needs.release-please.outputs.tag-name }}
 
@@ -122,6 +122,6 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
     with:
       prerelease: true