ci: scope pull request checks to what the diff can affect

[waleedlatif1]

Summary

Every PR ran the full suite. A library post with one .mdx and one cover .jpg (#8931) cost 107 job-minutes, about 755 vCPU-minutes, and took 21 minutes. Of the last 400 merged PRs, 75 were content-only, 7 desktop-only and 3 docs-app-only.

A new changes job (2 vCPU, ~10s) runs .github/scripts/ci-changes.sh. It replaces desktop-live-changes.sh and its job, fetches only the PR's base commit, and outputs which job groups the diff can affect.

Diff touches only	Runs
Content: apps/sim/content/** except .tsx, and content-only public assets	lint, test (og-image.test.ts checks covers), build (next build renders every post)
apps/docs/**	lint, test (docs tests and two scripts tests read docs pages)
apps/desktop/**	lint, test, desktop-live
Agent guidance (.agents, .claude, .cursor, AGENTS.md/CLAUDE.md, root README)	lint (check:skills, check:guidance-refs)
Anything else, including any .github change, an empty diff or a diff that can't be computed	everything

It fails safe:

• The classifier only allows skips for paths on an allowlist. Anything unmatched, a failed fetch, or a missing base runs every job.
• Push, dispatch and every other non-PR event always run the full suite, so the migrate → promote deploy chain never runs on partial checks.
• packages/desktop-bridge and browser-protocol run everything, because 64 apps/sim files import them.
• The ci aggregator accepts a skipped job only when changes set that job's flag to exactly false. A failed or skipped changes, or missing outputs, fails ci.
• Lint always runs.

Effect: a content PR goes from about 755 to about 152 vCPU-minutes, and from 21 minutes of wall time to about 5.5.

Test plan

• scripts/ci-changes.test.ts runs the real script against real git repos (20 cases, each guard checked by revert)
• This PR touches .github, so its own run must show changes choosing the full suite and every job running

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 12, 2026 10:21pm UTC

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking issue remains.

Summary

This PR scopes pull request checks by changed paths while keeping full checks for non-PR events.

• Pull requests now run only the checks their changed paths can affect.
• The required ci check now accepts only classifier-approved skipped jobs.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Workflow event] --> B{Pull request?}
  B -->|Yes| C[Classify changed paths]
  B -->|No| D[Run full suite]
  C --> E[Run checks selected by flags]
  C -->|Unknown paths or diff failure| D
  E --> F[ci gate]
  D --> F
  L[Lint always runs] --> F
  F --> G{All checks passed or explicitly allowed skips?}
  G -->|Yes| H[Pass]
  G -->|No| I[Fail]

Loading

_{Reviews (2) · Last reviewed commit: "ci: move the ci gate into a tested scrip..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic</sub>