ci: run chain and dom only in the merge queue, and close two path-filter holes (CL-12132)

.github/workflows/ci.yml

@@ -45,18 +45,17 @@ jobs:
       - if: env.RUN == 'true'
         run: bun run check
 
-  # Each suite runs on a pull request only when it touches what the suite covers.
+  # Each suite runs on a pull request only when it touches what the suite covers; dom runs only in the merge queue.
   test:
     needs: changes
     if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     env:
       RUN: >-
-        ${{ github.event_name != 'pull_request' || needs.changes.outputs.shared == 'true'
+        ${{ github.event_name != 'pull_request' || (matrix.suite != 'dom' && (needs.changes.outputs.shared == 'true'
         || (matrix.suite == 'unit' && (needs.changes.outputs.hub == 'true' || needs.changes.outputs.web == 'true'))
-        || (matrix.suite == 'postgres' && needs.changes.outputs.hub == 'true')
-        || (matrix.suite == 'dom' && needs.changes.outputs.web == 'true') }}
+        || (matrix.suite == 'postgres' && needs.changes.outputs.hub == 'true'))) }}
     strategy:
       fail-fast: false
       matrix:
@@ -84,11 +83,11 @@ jobs:
     permissions:
       pull-requests: read
     outputs:
-      platform: ${{ steps.filter.outputs.platform }}
       shared: ${{ steps.filter.outputs.shared }}
       hub: ${{ steps.filter.outputs.hub }}
       web: ${{ steps.filter.outputs.web }}
       code: ${{ steps.code.outputs.code }}
+      docker: ${{ steps.docker.outputs.docker }}
     steps:
       - id: filter
         if: github.event_name == 'pull_request'
@@ -100,6 +99,7 @@ jobs:
               - 'vendor/**'
               - 'tooling/**'
               - 'tests/**'
+              - 'skills/**'
               - 'bun.lock'
               - 'package.json'
               - 'tsconfig*.json'
@@ -110,19 +110,6 @@ jobs:
             web:
               - 'apps/web/**'
               - 'apps/extension/**'
-            platform:
-              - 'apps/hub/**'
-              - 'apps/sidecar/**'
-              - 'apps/web/scripts/**'
-              - 'apps/web/src/lib/**'
-              - 'tooling/**'
-              - 'packages/**'
-              - 'tests/chain/**'
-              - 'vendor/**'
-              - 'bun.lock'
-              - 'package.json'
-              - '.github/workflows/ci.yml'
-              - '.github/actions/**'
       # Set when any changed file is more than Markdown.
       - id: code
         if: github.event_name == 'pull_request'
@@ -133,17 +120,30 @@ jobs:
             code:
               - '**'
               - '!**/*.md'
+      - if: github.event_name == 'merge_group'
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - id: docker
+        if: github.event_name == 'merge_group'
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          filters: |
+            docker:
+              - 'Dockerfile'
+              - 'apps/*/Dockerfile*'
+              - 'bun.lock'
+              - '.github/workflows/**'
 
-  # Every shard job reports so its required check is satisfied; the steps run only when platform code changed.
+  # Every shard job reports so its required check is satisfied; the steps run only in the merge queue.
   # Each shard lists its files: the slow scenarios are spread by measured time, which --shard cannot do.
   chain:
     name: chain (${{ matrix.shard }})
-    needs: changes
     if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     env:
-      RUN: ${{ github.event_name != 'pull_request' || needs.changes.outputs.platform == 'true' }}
+      RUN: ${{ github.event_name != 'pull_request' }}
     strategy:
       fail-fast: false
       matrix:
@@ -188,8 +188,12 @@ jobs:
           persist-credentials: false
       - uses: corbitsdev/corbits-triage/packages/policy-check-action@fadfc025e385b9c3e796d94c2c66a4435b4df12f
 
+  # In the merge queue the images are built without pushing, only when what they are built from changed.
   sidecar:
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    needs: changes
+    if: >-
+      ${{ !cancelled() && (github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+      || (github.event_name == 'merge_group' && needs.changes.outputs.docker == 'true')) }}
     permissions:
       contents: read
       packages: write
@@ -200,6 +204,7 @@ jobs:
 
   hub:
     needs: sidecar
+    if: ${{ !cancelled() && needs.sidecar.result == 'success' }}
     permissions:
       contents: read
       packages: write