ci: optimize PR CI time and skip Netlify previews for non-docs changes

[devin-ai-integration]

Summary

Reduces the time and number of tasks that run for abapify/adt-cli PR CI, and makes Netlify deploy previews skip non-docs PRs.

1. Avoids heavy CI work for docs-only PRs without blocking required checks. The workflow always runs, but setup-node, setup-bun, bun install, nx-set-shas, and all nx tasks are skipped when the only changed files are under website/, docs/, *.md, or netlify.toml.
2. Cancels stale workflow runs only for PRs (cancel-in-progress: ${{ github.event_name == 'pull_request' }}), so main builds still populate the Nx Cloud cache.
3. Caches ~/.bun/install/cache across runs.
4. Limits nx format:check to changed files via --base=$NX_BASE --head=$NX_HEAD.
5. Calls nx and nx-cloud from ./node_modules/.bin/ so SonarCloud sees locked, installed binaries instead of package-manager install helpers.
6. Hardens netlify.toml so deploy previews are skipped unless the PR touches website/ or netlify.toml.

What changed

.github/workflows/ci.yml

• Removed trigger-level paths-ignore and added a Check for code changes job step. This keeps the required main check green for docs-only PRs while still skipping bun install, nx report, format:check, affected, and nx-cloud fix-ci.
• concurrency.cancel-in-progress now only applies to pull_request events.
• Added actions/cache for ~/.bun/install/cache.
• nx format:check is scoped to the affected range (--base=$NX_BASE --head=$NX_HEAD).
• npx/bunx calls are replaced with ./node_modules/.bin/nx and ./node_modules/.bin/nx-cloud.

.github/workflows/copilot-setup-steps.yml

• Added concurrency.
• Added the same bun dependency cache.

netlify.toml + website/scripts/netlify-ignore.cjs

• Replaced the inline git diff ignore command with a Node script that:
  • Uses spawnSync('/usr/bin/git', [...]) with no shell interpolation.
  • Checks the Netlify cached commit diff first.
  • Falls back to the GitHub PR files API for deploy previews, validating REVIEW_ID before using it.
  • Skips when the PR does not touch website/ or netlify.toml, and builds when it cannot determine changed files.

For private repos, set GITHUB_TOKEN in the Netlify site environment so the PR files API is not rate-limited.

Out of scope

The third-party app checks that appear on PRs (Netlify header/redirect rules, Codacy, SonarCloud, CodeScene, CodeRabbit, Cubic, Devin Review, etc.) are configured in GitHub app settings, not in repository code. This PR addresses the parts we can control from the repo; I still recommend auditing the installed apps and disabling duplicate AI reviewers/quality gates that do not provide signal you act on.

Link to Devin session: https://app.devin.ai/sessions/8ff3ba8bbf284b8da13c955bf9ad845f
Requested by: @ThePlenkov

---

[devin-ai-integration]

Original prompt from Petr

i don't think tasks like this must be run in PR CI https://github.com/abapify/adt-cli/pull/143/checks?check_run_id=89453960039. Can you ingeneral review all CI CD takss in main and PRs and advise how we can imporve CI CD time and minimaizae unumber of runs/tasks

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[netlify]

✅ Deploy Preview for adt-cli canceled.

Name	Link
🔨 Latest commit	7d6f9d3
🔍 Latest deploy log	https://app.netlify.com/projects/adt-cli/deploys/6a6351c5e510f100082f71d3

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 7d6f9d3

Command	Status	Duration	Result
nx affected -t lint test build e2e-ci --verbose...	✅ Succeeded	5s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-07-24 11:52:20 UTC

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[devin-ai-integration]

/act closing summary

• Status: merged (squash commit 924a3cb).
• HEAD before merge: 7d6f9d3.
• Review fixes: corrected the docs-only path-filter regex in .github/workflows/ci.yml so files inside website/ and docs/ are correctly skipped (^website/|^docs/|\ .md$|^netlify\.toml$).
• Threads: 5 open review threads resolved after per-thread replies/fixes.
• CI on PR head: all required checks green.
• SAST (PR): SonarCloud quality gate for PR ci: optimize PR CI time and skip Netlify previews for non-docs changes #145 is OK.
• Left / out of scope: main branch SonarCloud quality gate was already ERROR before this merge (same new_reliability_rating/new_security_rating conditions on the previous analysis ba0dfd40); those issues are not introduced by this PR.

[devin-ai-integration]

Devin Review found 3 new potential issues.