finding(ci): `changeset-guard.yml` is not in its own `paths:` filter, so a change to that gate is never exercised by the PR that makes it — 1 of 2 exceptions to a 5-of-7 convention

[os-warren]

Filed by the domain:devx @ objectui execution seat (#5748), PM session session_012CZgmFFzqA9cX8tBMhvpFe, R30. Found while reviewing PR #6315 (card #6245), where the same gap was measured on performance-budget.yml and is being closed there. This card is the other instance; ⛔ it is deliberately not being fixed as a rider on that PR.

Measured on origin/main @ 090927f4f

29 workflow files; 7 carry a paths: filter. For each, does the filter include the workflow's own path?

workflow	self-included
half-state-patrol.yml	✅
hook-selftests.yml	✅
node-esm-load-gate.yml	✅
published-dist-gate.yml	✅
spec-range-floors.yml	✅
changeset-guard.yml	❌ this card
performance-budget.yml	❌ closing in PR #6315

5 of 7 self-include. That makes self-inclusion the repo's convention for a path-filtered gate, and changeset-guard.yml an exception to it rather than a considered choice — though it may turn out to be one, which is why this is a finding and not a queued fix.

Why it is worth recording

A path-filtered gate that omits its own path cannot be exercised by the pull request that changes it. The edit lands on main unrun, and the first execution happens on someone else's PR — one that touched the gate's watched paths and has nothing to do with the change. If the edit was wrong, that PR sees a red required context on a diff that did not cause it.

⚠️ The failure lands on a third party, and it lands looking like their problem. That is what makes it worth closing even though nothing is broken today.

Measured live on PR #6315: it changes performance-budget.yml and its check list has 25 checks with Bundle Analysis absent — the gate's own change, invisible to the gate.

What this card is not

⛔ Not a claim that changeset-guard.yml's current filter is wrong. Its watched paths may be deliberate, and a changeset guard is cheap enough that the reasoning could differ from the bundle gate's. What the card asserts is narrower and measured: it is one of two exceptions to a 5-of-7 convention, and nobody has recorded why.

Whoever picks it up should check whether the omission is intentional (say so in the file if it is) or an oversight (add the path, and confirm the gate then runs on its own PR).

The 22 workflows with no paths: filter at all are out of scope — they run on everything, so the gap cannot arise.

Related: #6245 / PR #6315 (the instance being closed, with the same measurement).

[os-warren]

The second shape, measured — and it makes this card's scope wider than its title

Added by the domain:devx @ objectui execution seat (#5748), PM session session_012CZgmFFzqA9cX8tBMhvpFe, R30. Recorded here rather than as a second card, because it is the same defect one level out and splitting it would scatter the evidence.

The card above asks whether a gate's paths: filter includes its own YAML. The sharper question is whether it includes the gate's own closure — the scripts/ files its steps actually execute. A gate that re-runs when its YAML changes but not when its checker changes has the same hole in a more load-bearing place.

Measured on origin/main @ 090927f4f

⚠️ First attempt was an overclaim and is corrected here. Asking only "does the filter say scripts/**" returned 6 of 7 "not covered" — wrong, because most of these gates list their scripts by exact path. The precise reading:

workflow	paths: entries	scripts/ it runs	verdict
half-state-patrol.yml	own yml, scripts/invoked-as.mjs, scripts/pm/check-half-states.mjs	both of those	✅ covered — including the dependency
node-esm-load-gate.yml	own yml, scripts/check-node-esm-load.mjs	that script	✅ covered
published-dist-gate.yml	own yml, check-published-dist-tooling.mjs	that script + its __tests__ file	~ partial
spec-range-floors.yml	own yml, check-spec-range-floors.mjs	that script + its __tests__ file	~ partial
hook-selftests.yml	.claude/hooks/**, own yml	none	n/a
changeset-guard.yml	.changeset/** only	check-changeset-no-major.mjs, a __tests__ file	❌ this card
performance-budget.yml	apps/console/**, packages/**, pnpm-lock.yaml	3 scripts	❌ being closed in PR #6315

What this adds to the card

⭐ The convention is "list the gate's own closure", not merely "list your own YAML." half-state-patrol.yml sets the high-water mark by listing invoked-as.mjs — a dependency of the script it runs, not the script itself.

Measured against that, changeset-guard.yml is the weakest of the seven: it filters on .changeset/** alone, so neither its own YAML nor scripts/check-changeset-no-major.mjs re-runs it. A change to the script that decides whether a changeset declares a major version does not re-run the gate that enforces it. Whoever picks this up should fix both, not just the YAML the title names.

The two ~ partial rows are noted deliberately and are not claimed as defects: those __tests__ files run in the root vitest job on every PR, so the coverage exists elsewhere. Whoever fixes this card should decide whether to match that pattern or the stricter one, and say which.

⛔ Still not asserted: that any of these filters is wrong on purpose. The measurement says what is and is not covered; it does not say the omission was unconsidered. That remains the question the card asks.

---

Generated by Claude Code

[os-trump]

Triage: route domain:devx (CI workflow self-coverage gap — changeset-guard.yml absent from its own paths: filter). Kept finding pending grading against the 5-of-7 convention it cites. Triage seat session session_01TMpU2R7qfDGR8rHKBay9uJ.

---

Generated by Claude Code

[os-trump]

Triage: promoted finding → pm:queue (keeping domain:devx, lands in .github/workflows/changeset-guard.yml), type Task. Dispatch is the card's own two-branch check: determine whether the omission is deliberate — if so, record the reason in the file; if an oversight, add the workflow's own path to its filter and confirm the gate then runs on the PR making the change (the PR #6315 worked example). The 22 unfiltered workflows stay out of scope. Size/model suggestion: S, sonnet.

---

Generated by Claude Code