From 93722101498fbb875bb0aaaf3468860da2133d88 Mon Sep 17 00:00:00 2001 From: Yaroslav Zhavoronkov Date: Wed, 25 Mar 2026 22:41:45 -0700 Subject: [PATCH] ci: scope Nix Build workflow to flake and dependency changes The Nix build only adds value over CI when the build recipe or Go dependencies change. Scope the trigger to flake.nix, flake.lock, go.mod, and go.sum so pure Go source changes skip the Nix build (already covered by the CI workflow). Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/nix-build.yml | 10 +++++----- CLAUDE.md | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml index 5d4739f..5e5b6f2 100644 --- a/.github/workflows/nix-build.yml +++ b/.github/workflows/nix-build.yml @@ -3,11 +3,11 @@ name: Nix Build on: pull_request: branches: [main] - paths-ignore: - - "*.md" - - "**/*.md" - - LICENSE - - NOTICE + paths: + - flake.nix + - flake.lock + - go.mod + - go.sum permissions: {} diff --git a/CLAUDE.md b/CLAUDE.md index 2f27288..a9f005c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -445,8 +445,8 @@ When `go.mod` or `go.sum` change, the `vendorHash` in `flake.nix` must be update ## CI/CD - **CI** (`.github/workflows/ci.yml`) — runs on pushes to non-main branches: `go fmt` check, `go test` with `DNSSEC_LIVE_TEST=1`, `go vet`, `go build`. Skipped for doc-only changes (`*.md`, `LICENSE`, `NOTICE`). -- **Nix Build** (`.github/workflows/nix-build.yml`) — runs on PRs targeting main: `nix build .#docker-image` (runs offline test suite via `doCheck`). Catches flake breakage before merge. Skipped for doc-only changes (`*.md`, `LICENSE`, `NOTICE`). -- Branch protection on main should require both `Test` and `Build` status checks to pass. If using GitHub rulesets, mark them as "skippable" so doc-only PRs are not blocked when the Nix Build workflow is skipped by `paths-ignore`. +- **Nix Build** (`.github/workflows/nix-build.yml`) — runs on PRs targeting main only when Nix or Go dependency files change (`flake.nix`, `flake.lock`, `go.mod`, `go.sum`). Pure Go source changes are already covered by CI; the Nix build catches flake recipe breakage and `vendorHash` mismatches. +- Branch protection on main should require both `Test` and `Build` status checks to pass. If using GitHub rulesets, mark them as "skippable" so PRs without Nix/dependency changes are not blocked when the Nix Build workflow is skipped by `paths`. - **Release** (`.github/workflows/release.yml`) — runs on push to main, three sequential jobs: 1. **Build** — `nix build .#docker-image` (runs tests via `doCheck`), uploads image tarball as artifact 2. **Release** — Release Please creates/updates a release PR; on merge, creates a GitHub Release + tag