fix(ci): ignore paths in merge queue (lints-only)

[LesnyRumcajs]

Summary of changes

Changes introduced in this pull request:

• this should save some minutes, I was pretty surprised to learn merge queues are exempt from filtering, see https://github.com/orgs/community/discussions/45899

Reference issue to close (if applicable)

Closes

Other information and links

Change checklist

• I have performed a self-review of my own code,
• I have made corresponding changes to the documentation. All new code adheres to the team's documentation standards,
• I have added tests that prove my fix is effective or that my feature works (if possible),
• I have made sure the CHANGELOG is up-to-date. All user-facing changes should be reflected in this document.

Outside contributions

• I have read and agree to the CONTRIBUTING document.
• I have read and agree to the AI Policy document. I understand that failure to comply with the guidelines will lead to rejection of the pull request.

Summary by CodeRabbit

• Chores
  • Updated several automated checks to run only when relevant files change.
  • This reduces unnecessary CI work and avoids issues with merge-group events that don’t support path filters.
  • Affected checks include Actions lint, Docker lint, docs, Go lint, link validation, list lint, Ruby lint, ShellCheck, and YAML lint.

[coderabbitai]

Walkthrough

Nine GitHub Actions lint workflows (actions-lint, docker-lint, docs-check, go-lint, link-check, lists-lint, rubocop, shellcheck, yaml-lint) each receive a new preliminary "changes" job using dorny/paths-filter to detect relevant file modifications, exposing a changesFound output. Existing lint jobs are updated with needs/if conditions to run only when changes are detected, addressing merge_group's lack of path-filter support.

Changes

Workflow gating for conditional lint execution

Layer / File(s)	Summary
actions-lint changes gating .github/workflows/actions-lint.yml	Adds changes job checking workflow files, .github/actionlint.yaml, and mise.toml; gates actions-lint on changesFound.
docker-lint changes gating .github/workflows/docker-lint.yml	Adds changes job checking Dockerfiles and docker-compose paths; gates docker-lint on changesFound.
docs-check changes gating .github/workflows/docs-check.yml	Adds changes job checking Markdown, docs/**, and spellcheck config paths; gates docs-check on changesFound.
go-lint changes gating .github/workflows/go-lint.yml	Adds changes job checking go.work, mise.toml, and Go source paths; gates lint-go on changesFound or workflow_dispatch.
link-check changes gating .github/workflows/link-check.yml	Adds changes job checking Markdown/MDX/HTML paths; gates link-check on changesFound, workflow_dispatch, or schedule.
lists-lint changes gating .github/workflows/lists-lint.yml	Adds changes job checking test snapshot files; gates lists-lint on changesFound.
rubocop changes gating .github/workflows/rubocop.yml	Adds changes job checking Ruby files; gates rubocop on changesFound.
shellcheck changes gating .github/workflows/shellcheck.yml	Adds changes job checking shell script files; gates shellcheck on changesFound.
yaml-lint changes gating .github/workflows/yaml-lint.yml	Adds changes job checking YAML files; gates yaml-lint on changesFound.

Estimated code review effort: 2 (Simple) | ~12 minutes

Possibly related PRs

• ChainSafe/forest#5910: Introduces/configures the go-lint.yml workflow that this PR extends with paths-filter gating.
• ChainSafe/forest#6450: Introduces/adjusts several per-filetype lint workflows (docker-lint, lists-lint, rubocop) that this PR modifies with the same gating pattern.

Suggested labels:github_actions

Suggested reviewers:hanabi1224, akaladarshi

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the CI change to skip lint workflows in merge queue runs based on path changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch skip-lints-merge-queue

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch skip-lints-merge-queue

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 6

🧹 Nitpick comments (1)

.github/workflows/link-check.yml (1)

42-46: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Filter scope is broader than what's actually linted.

The filter matches **.md, **.mdx, **.html recursively, but the lychee step only scans ./*.md and ./AGENTS.md (top-level, not recursive). Nested markdown/HTML changes will trigger the job even though they aren't scanned, partially defeating the CI-time-saving goal of this PR.

♻️ Narrow the filter to match actual scan scope

 filters: |
changesFound:
- - '**.md'- - '**.mdx'- - '**.html'+ - '*.md'+ - 'AGENTS.md'
- '.github/workflows/link-check.yml'

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/link-check.yml around lines 42 - 46, The path filter is
broader than the files actually checked by the link checker, so update the
`changesFound` patterns in the link-check workflow to match the `lychee` scan
scope. Use the workflow’s existing `lychee` step as the source of truth and
narrow the recursive markdown/HTML globs so only top-level files that are truly
scanned will trigger the job. Keep the `.github/workflows/link-check.yml`
self-watch entry intact.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/actions-lint.yml:
- Line 36: The checkout step in the actions-lint workflow should not persist
credentials because it is read-only and only used for path filtering. Update the
actions/checkout usage in the workflow to set persist-credentials to false so no
token is retained after the checkout step.
In @.github/workflows/docker-lint.yml:
- Line 40: The read-only checkout in the docker-lint workflow is missing the
same credentials hardening used elsewhere. Update the actions/checkout step in
the docker-lint job to set persist-credentials to false, matching the pattern
from the changes job in actions-lint.yml and keeping the checkout read-only.
In @.github/workflows/docs-check.yml:
- Line 40: The read-only checkout in the docs-check workflow still uses
actions/checkout without disabling stored credentials. Update the checkout step
to set persist-credentials to false so the repo token is not retained; this
applies to the checkout entry in the workflow and should be changed directly on
the actions/checkout invocation.
In @.github/workflows/go-lint.yml:
- Around line 46-51: The go-lint workflow filter is missing some Go source
paths, so changes under tools/prometheus_metrics_validator/** will not trigger
the job. Update the paths-filter configuration in the go-lint workflow to
include that directory, or replace the current narrow Go path entries with a
broader matcher such as **/*.go if the lint job should run for all Go source
changes. Use the existing changesFound filter block as the place to make this
adjustment.
In @.github/workflows/shellcheck.yml:
- Line 34: The checkout step is using actions/checkout@v7 without disabling
persisted credentials; update the shellcheck workflow’s checkout job to set
persist-credentials to false on the read-only checkout. Locate the
actions/checkout invocation in the workflow and add the credential persistence
override so this job cannot reuse the default token after checkout.
In @.github/workflows/yaml-lint.yml:
- Line 36: The checkout step in the YAML lint workflow uses actions/checkout
without disabling credential persistence; update the read-only checkout to set
persist-credentials to false. Make this change on the checkout action used in
the workflow so it matches the other read-only jobs and avoids leaving Git
credentials available after checkout.
---
Nitpick comments:
In @.github/workflows/link-check.yml:
- Around line 42-46: The path filter is broader than the files actually checked
by the link checker, so update the `changesFound` patterns in the link-check
workflow to match the `lychee` scan scope. Use the workflow’s existing `lychee`
step as the source of truth and narrow the recursive markdown/HTML globs so only
top-level files that are truly scanned will trigger the job. Keep the
`.github/workflows/link-check.yml` self-watch entry intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 9a66ace6-ba5e-449d-9058-ecc58ae03e75

📥 Commits

Reviewing files that changed from the base of the PR and between b4e5736 and bb389b2.

📒 Files selected for processing (9)

• .github/workflows/actions-lint.yml
• .github/workflows/docker-lint.yml
• .github/workflows/docs-check.yml
• .github/workflows/go-lint.yml
• .github/workflows/link-check.yml
• .github/workflows/lists-lint.yml
• .github/workflows/rubocop.yml
• .github/workflows/shellcheck.yml
• .github/workflows/yaml-lint.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• filecoin-project/lotus(manual)