From ec85fe026ade8ca73151140e9da02f3c8f387cd1 Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Sat, 13 Jun 2026 12:13:58 -0400
Subject: [PATCH] ci(260613-fp9): fix changes paths-filter so
 doc/.gitea/.planning PRs skip heavy jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

dorny/paths-filter combines patterns with Array.some, and picomatch compiles
'!.gitea/**' as 'any path not under .gitea'. The '- !.gitea/**' line (from
quick task 260613-dmw) therefore matched every non-.gitea file — including
.planning/** and *.md — so code=true for doc-only PRs and the heavy api/harness
jobs ran anyway. It also never excluded .gitea (the **/*.yml glob already
matched workflow files), regressing the Phase 15 doc-only skip.

Switch to predicate-quantifier 'every' with negation-only globs: a file counts
as code only if it is outside .gitea/, outside .planning/, and not Markdown.
Verified with picomatch against representative file sets.
---
 .gitea/workflows/ci.yml | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6d8b0a2..e8548d4 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -16,20 +16,22 @@ jobs:
       - uses: dorny/paths-filter@v4
         id: filter
         with:
+          # 'every' + negation-only globs. dorny combines a filter's patterns with
+          # Array.some by default, and picomatch compiles '!.gitea/**' as "matches any
+          # path NOT under .gitea" — so under 'some' that single line matched EVERY
+          # non-.gitea file (incl. .planning/** and *.md), flipping code=true for
+          # doc-only PRs and silently running the heavy api/harness jobs (regression
+          # introduced by quick task 260613-dmw; the old positive allowlist also never
+          # actually excluded .gitea because '**/*.yml' already matched workflow files).
+          # With predicate-quantifier 'every' a changed file counts as "code" ONLY if it
+          # matches ALL patterns — i.e. it is outside .gitea/, outside .planning/, and is
+          # not Markdown. Verified against representative file sets in quick task 260613-fp9.
+          predicate-quantifier: 'every'
           filters: |
             code:
-              - '**/*.ts'
-              - '**/*.tsx'
-              - '**/*.js'
-              - '**/*.json'
-              - '**/*.yaml'
-              - '**/*.yml'
-              - 'apps/**'
-              - 'packages/**'
-              - 'pnpm-lock.yaml'
-              - 'Dockerfile'
-              - 'docker-compose*.yml'
               - '!.gitea/**'
+              - '!.planning/**'
+              - '!**/*.md'
 
   fast-checks:
     runs-on: ubuntu-latest