From cfb7052bf2a85f24518c5f2ee5b838c75bc61102 Mon Sep 17 00:00:00 2001
From: kikashy <35789537+kikashy@users.noreply.github.com>
Date: Mon, 26 Oct 2026 07:46:48 -0400
Subject: [PATCH] CI: run the checks a pull request's changed paths map to
 (jpdev.json mapping)

jpdev.json gains a `changed` mapping from each dev.json step's inputs. On a
pull request the Runner jobs run `check.sh --all --changed origin/<base>`
less the four release steps; a push to main and the release call keep the
whole list. Release contents is unchanged.

Signed-off-by: kikashy <35789537+kikashy@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 21 ++++++++++++++--
 AGENTS.md                | 11 +++++++++
 CLAUDE.md                | 11 +++++++++
 jpdev.json               | 53 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 94 insertions(+), 2 deletions(-)
 create mode 100644 jpdev.json

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d96e66..50653ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,9 @@ name: CI
 # the longer steps are scripts under scripts/checks/ with the comments they had here. Two jobs, both
 # required by branch protection under their names: `Runner (<os>)` runs every step but the release
 # ones on Linux and macOS, and `Release contents` runs the release steps with the exact toolchain
-# release.yml names.
+# release.yml names. On a pull request the `Runner` jobs run only the steps jpdev.json maps the
+# changed paths to (`check.sh --changed`); on a push to main, and when release.yml calls this
+# workflow at a tag, they run the whole list. `Release contents` runs its four steps every time.
 
 on:
   pull_request:
@@ -26,7 +28,10 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
+      # The whole history, so that --changed finds the merge base with the base branch.
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       # First, so that a manifest that does not parse fails before the long steps start.
       - name: The manifest parses and its first step runs
         run: scripts/dev/check.sh --manifest dev.json --only local-paths
@@ -36,8 +41,20 @@ jobs:
           cache: true
       # The pinned Runtimes, the ownership-era Runner and the Gateway are checked out and built by
       # the build-pinned step (scripts/checks/build-pinned.sh).
+      # A pull request runs the steps jpdev.json maps its changed paths to, and the whole list when
+      # a path is unmapped or the mapping, dev.json or the runner changed. A push to main runs the
+      # whole list, and only that run is what a release is held to. The release steps are skipped
+      # here either way: `Release contents` runs them.
       - name: Checks
-        run: scripts/dev/check.sh --all --skip release-toolchain,third-party-notices,release-archives,release-programs
+        env:
+          EVENT: ${{ github.event_name }}
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          if [ "$EVENT" = pull_request ]; then
+            scripts/dev/check.sh --all --changed "origin/$BASE_REF" --skip release-toolchain,third-party-notices,release-archives,release-programs
+          else
+            scripts/dev/check.sh --all --skip release-toolchain,third-party-notices,release-archives,release-programs
+          fi
 
   # What a repository release carries (docs/releasing.md), checked on every
   # commit so a tag is never the first to find a gap. The toolchain is the exact
diff --git a/AGENTS.md b/AGENTS.md
index 26addc8..467b71e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -70,6 +70,17 @@ summary block, and anything you stopped on or chose not to do.
   from pinned Runtime, Gateway and old-Runner commits (it needs network access to fetch them). A
   pin and the release name beside it are moved together. The two test steps fail if a named test
   does not run and pass, so a skip is a failure there.
+- A pull request's `Runner` jobs run `scripts/dev/check.sh --all --changed origin/<base>` (less
+  the four release steps): only the steps `jpdev.json` maps the changed paths to, and the whole
+  list when a changed path matches no rule (the workflows, `.gitattributes`, `.gitignore`, a file
+  in a new place) or when `jpdev.json`, `dev.json` or the runner changed. A push to `main` runs the
+  whole list, and only that run is what a release is held to; `Release contents` always runs its
+  four steps. Run the same selection locally with `scripts/dev/check.sh --changed origin/main` (or
+  `jpdev check --changed`). The test steps need `build-pinned` first, so every rule that selects
+  `manual-gate`, `unit-tests` or `chain-tests` selects `build-pinned` too. The Go tests read
+  `openapi.json`, `vectors/`, `docs/MAPPING-V2.md`, `docs/design/*.json` and test data across
+  packages, so those paths select the test steps. A new step, a new input of a step or a test that
+  reads a new file is mapped in `jpdev.json`; when unsure, map it broader.
 - Runner is a single-owner local Jobs pilot; do not add shared-user permissions, external actions
   or agent loops. Do not put real credentials, customer evidence or private operational records in
   examples or fixtures.
diff --git a/CLAUDE.md b/CLAUDE.md
index 26addc8..467b71e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -70,6 +70,17 @@ summary block, and anything you stopped on or chose not to do.
   from pinned Runtime, Gateway and old-Runner commits (it needs network access to fetch them). A
   pin and the release name beside it are moved together. The two test steps fail if a named test
   does not run and pass, so a skip is a failure there.
+- A pull request's `Runner` jobs run `scripts/dev/check.sh --all --changed origin/<base>` (less
+  the four release steps): only the steps `jpdev.json` maps the changed paths to, and the whole
+  list when a changed path matches no rule (the workflows, `.gitattributes`, `.gitignore`, a file
+  in a new place) or when `jpdev.json`, `dev.json` or the runner changed. A push to `main` runs the
+  whole list, and only that run is what a release is held to; `Release contents` always runs its
+  four steps. Run the same selection locally with `scripts/dev/check.sh --changed origin/main` (or
+  `jpdev check --changed`). The test steps need `build-pinned` first, so every rule that selects
+  `manual-gate`, `unit-tests` or `chain-tests` selects `build-pinned` too. The Go tests read
+  `openapi.json`, `vectors/`, `docs/MAPPING-V2.md`, `docs/design/*.json` and test data across
+  packages, so those paths select the test steps. A new step, a new input of a step or a test that
+  reads a new file is mapped in `jpdev.json`; when unsure, map it broader.
 - Runner is a single-owner local Jobs pilot; do not add shared-user permissions, external actions
   or agent loops. Do not put real credentials, customer evidence or private operational records in
   examples or fixtures.
diff --git a/jpdev.json b/jpdev.json
new file mode 100644
index 0000000..d472e5f
--- /dev/null
+++ b/jpdev.json
@@ -0,0 +1,53 @@
+{
+  "version": 1,
+  "changed": [
+    {
+      "paths": ["**/*.go", "go.mod", "go.sum"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "go-fmt", "go-vet", "build-pinned", "manual-gate", "unit-tests", "chain-tests", "build", "third-party-notices"]
+    },
+    {
+      "paths": ["go.mod", "go.sum"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "release-toolchain", "release-archives"]
+    },
+    {
+      "paths": ["cmd/**", "internal/**", "tools/preparation-vectors/**"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "go-vet", "build-pinned", "manual-gate", "unit-tests", "chain-tests", "build"]
+    },
+    {
+      "paths": ["cmd/**"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "release-programs"]
+    },
+    {
+      "paths": ["vectors/**", "docs/MAPPING-V2.md", "docs/design/*.json"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "build-pinned", "manual-gate", "unit-tests", "chain-tests"]
+    },
+    {
+      "paths": ["openapi.json"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "openapi", "build-pinned", "manual-gate", "unit-tests", "chain-tests"]
+    },
+    {
+      "paths": ["scripts/checks/build-pinned.sh", "scripts/checks/manual-gate.sh", "scripts/checks/unit-tests.sh", "scripts/checks/chain-tests.sh"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "build-pinned", "manual-gate", "unit-tests", "chain-tests"]
+    },
+    {
+      "paths": ["THIRD_PARTY_NOTICES", "tools/third_party_notices.py"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "third-party-notices"]
+    },
+    {
+      "paths": ["tools/release_archives.py", "tools/test_release_archives.py"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "release-archives"]
+    },
+    {
+      "paths": [".goreleaser.yml", "scripts/checks/release-programs.sh"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "release-programs"]
+    },
+    {
+      "paths": ["scripts/checks/release-toolchain.sh"],
+      "checks": ["local-paths", "agent-docs", "diff-check", "release-toolchain"]
+    },
+    {
+      "paths": ["*.md", "docs/**", "LICENSE", "deploy/**", "scripts/checks/local-paths.sh", "scripts/sync-agent-docs.sh", "scripts/dev/handover_check.sh"],
+      "checks": ["local-paths", "agent-docs", "diff-check"]
+    }
+  ]
+}