fix(ci): a required check cannot be path-filtered — drop paths on the PR trigger (backend#1681)

[LukasWodka]

The bug

Source-of-truth drift is a required status check on develop and main, but drift-checks.yaml only fires on PRs touching scripts/**, client/** or itself.

A PR outside those paths therefore never produces the check. GitHub leaves it at "Expected — waiting for status to be reported", and the PR is unmergeable — with no failing check to point at, which is why it reads as "approved but stuck".

It is blocking three PRs right now

Measured 2026-08-11, all on develop, none touching the filtered paths:

PR
#651	org-standards sync (backend#1602)	BLOCKED
#657	Makefile pre-push hook	BLOCKED, approved
#660	docs	BLOCKED

The fix

pull_request loses its paths: filter, so the required check always reports. The job is ~10s (measured across its last three runs) — nothing next to a permanently stuck PR.

pushkeeps its filter: pushes aren't gated by required checks, so path-scoping there is free and correct.

Note

This repo already documents the exact hazard, in standard-checks.yml's own header:

a required status check must report on EVERY PR to the protected branch, or the PR sits forever at "Expected — waiting for status to be reported", blocking the merge

This applies that rule to the workflow that broke it.

Test plan

• yaml.safe_load confirms pull_request now carries only branches, and push still carries paths.
• actionlint clean.
• The real proof is this PR itself: it touches only .github/workflows/drift-checks.yaml, which is in the old filter — so to verify the fix, check that chore(devex): install a make check pre-push hook via make setup (backend#1606) #657 (which touches neither path) reports Source-of-truth drift once this merges.

Found by the round-2 pipeline audit, backend#1681. Parent epic: backend#1680.

---

Note

Low Risk
CI trigger-only change; the drift job still runs the same script, with slightly more PR runs (~10s each).

Overview
Fixes PRs stuck at Expected — waiting for status to be reported when they do not touch scripts/**, client/**, or the workflow file. Source-of-truth drift is required on develop and main, but a path-filtered workflow never runs on out-of-scope PRs, so GitHub never gets a status.

The pull_request trigger in .github/workflows/drift-checks.yaml now only lists branches; the paths filter is removed. Inline comments document why required checks must not be path-scoped on PRs. push still uses paths because pushes are not blocked by that required-check behavior.

^{Reviewed by Cursor Bugbot for commit f9691d4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[divyasinghds]

Approving — textbook-correct fix for a real, active blocker (three PRs stuck at 'Expected — waiting for status to be reported'). The diff does exactly the right thing:

• pull_request loses paths:, keeps branches: → the required Source-of-truth drift check now reports on every PR to the protected branches.
• push keeps its paths: filter — correct, since pushes aren't gated by required checks.
• No rename, so the required-check name mapping is preserved.

Checked beyond the diff: the drift job inspects the committed scripts/↔client/ state (not the PR diff), so a docs-only PR passes when no drift exists — confirmed by it passing green on this PR itself. Cost is ~10s (5s here), negligible next to a permanently stuck PR.

Good call documenting why there's deliberately no paths on pull_request inline at the site that broke it, so it won't be tidied back. ✅