Scope web-ci.yml jobs to the surface that actually changed

[WilfordGrimley]

Owner-directed CI path-scoping, 2026-07-25.

Summary

• web-ci.yml: added a changes job (plain git diff --name-only against the push's pre-image SHA — no third-party paths-filter action, matching this repo's existing convention of reaching for plain git diffing, e.g. upstream-drift-monitor.yml) that outputs backend/frontend booleans. Each surface's jobs (test-backend for MPCAutofill/**; test-frontend, merge-frontend-test-reports, build-frontend for frontend/**) now if: on the relevant flag, so e.g. a backend-only merge no longer runs the full 4-shard Playwright suite.
• Removed the duplicate test-pre-commit job from web-ci.yml. test-pre-commit.yml already runs pre-commit run --all-files unconditionally on every push to master (no path filter), so the copy inside web-ci.yml could never actually be deduplicated by path-scoping — test-pre-commit.yml would still run the identical check on the same push regardless. Chosen direction: drop, not scope (stated per the task's "whichever direction is cleaner" instruction). build-frontend's needs: no longer includes it; formatting/type-check coverage on the commit is unaffected since the standalone workflow's own status check still runs.
• cloudflare-static-site/** stays in the workflow's top-level on.push.paths (unchanged — out of scope, trigger-level not job-level) but isn't wired into any changes output: no job in this workflow currently reads that directory (its presence there predates the publish-* job removal noted in docs/infrastructure.md's CI/CD state notes). A push touching only that path now runs zero jobs here.

Deliberately NOT done: coverage-delta.yml path filter

Left coverage-delta.yml untouched. Reading it turned up that the task's premise doesn't hold: this isn't a backend-coverage check (it doesn't touch MPCAutofill/** at all) — it's a static parser over frontend/tests/**/*.spec.ts test-inventory/skip-state (issue #415, incident #389, the /editor route swap that silently skipped ~190 Playwright tests). Both the workflow's own header comment and docs/infrastructure.md's CI/CD state section document a deliberate no-path-filter design: "the gate's whole reason for existing is to catch a test-inventory change that's easy to miss amid an otherwise-unrelated-looking diff, so gating its own trigger behind a path filter would reintroduce the exact class of blind spot it's meant to close." It's pure stdlib Python, no install step, so the always-run cost is low. Adding a path filter here — to MPCAutofill/** as literally requested, or even to the technically-correct frontend/tests/** — would directly contradict this recorded rationale. Flagging for an explicit owner call rather than resolving it myself.

Branch-protection check for context: GET /repos/ProxyPrints/ProxyPrints.github.io/branches/master/protection → 404 ("Branch not protected"), so there's no required-check concern either way on this repo today.

Verification

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/web-ci.yml'))" → parses clean.
• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/coverage-delta.yml'))" → parses clean (unchanged file, confirmed still valid).
• No way to run GitHub Actions locally — deferred to real runs. Expected trigger matrix for the next few pushes to master, for the reviewer to check against:
  • Push touching only MPCAutofill/** → changes, test-backend run; test-frontend, merge-frontend-test-reports, build-frontend skip.
  • Push touching only frontend/** → changes, test-frontend (4 shards), merge-frontend-test-reports, build-frontend run; test-backend skips.
  • Push touching only cloudflare-static-site/** → changes runs, every other job skips.
  • Push touching both frontend/** and MPCAutofill/** → everything runs.
  • workflow_dispatch (manual) → everything runs (no before SHA to diff against, so the changes job's fallback treats it as "both surfaces changed").
  • test-pre-commit.yml (unaffected, separate workflow) still runs on every push to master regardless of path — that's now the only place formatting/type-checking runs on a master push.

Open items

1. Owner decision needed on coverage-delta.yml: keep it unscoped (as currently documented and left in this PR), or path-scope it and accept the blind-spot risk the existing comment warns about. No change made pending that call.