fix(ci): ship email templates + unblock dependabot PRs

Three coordinated fixes for the CI failures stacking up:

1. apps/api/.dockerignore: `dist` matched at any depth, silently
   stripping out src/templates/email/dist/ (the compiled JSON email
   templates). The full-stack-smoke test then failed at register-time
   with "Email template 'auth/confirm-your-email' not found". Add an
   `!src/templates/email/dist` exception.

2. apps-ui-bundle-diff.yml: skip size-diff for Dependabot PRs. The
   action fails with "Parameter token or opts.auth is required"
   because Dependabot's GITHUB_TOKEN is read-only. The comment isn't
   useful on bot bumps anyway. Guard with
   `if: github.actor != 'dependabot[bot]'`.

3. Strip pull_request: paths: filters from all 12 required-check
   workflows. Only the `validate` job had no PR-side path filter, so
   it was the only required check that ran on every PR — the other 8
   never posted a status for PRs outside their paths, leaving every
   Dependabot PR BLOCKED on missing required checks forever. Push-side
   paths filters stay, so main-branch CI remains targeted.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: agjs

.github/workflows/apps-api-ci.yml

@@ -7,9 +7,7 @@ on:
       - "apps/api/**"
       - ".github/workflows/apps-api-ci.yml"
   pull_request:
-    paths:
-      - "apps/api/**"
-      - ".github/workflows/apps-api-ci.yml"
+    branches: [main]
 
 # Cancel in-flight runs of the same ref on a new push.
 concurrency:

.github/workflows/apps-api-security-deps.yml

@@ -7,9 +7,7 @@ on:
       - "apps/api/**"
       - ".github/workflows/apps-api-security-deps.yml"
   pull_request:
-    paths:
-      - "apps/api/**"
-      - ".github/workflows/apps-api-security-deps.yml"
+    branches: [main]
   schedule:
     - cron: "23 6 * * 1"
 

.github/workflows/apps-api-security-sast.yml

@@ -7,9 +7,7 @@ on:
       - "apps/api/**"
       - ".github/workflows/apps-api-security-sast.yml"
   pull_request:
-    paths:
-      - "apps/api/**"
-      - ".github/workflows/apps-api-security-sast.yml"
+    branches: [main]
   schedule:
     - cron: "29 6 * * 1"
 

.github/workflows/apps-api-security-secrets.yml

@@ -7,9 +7,7 @@ on:
       - "apps/api/**"
       - ".github/workflows/apps-api-security-secrets.yml"
   pull_request:
-    paths:
-      - "apps/api/**"
-      - ".github/workflows/apps-api-security-secrets.yml"
+    branches: [main]
   schedule:
     - cron: "17 6 * * 1"
 

.github/workflows/apps-docs-security-deps.yml

@@ -7,9 +7,7 @@ on:
       - "apps/docs/**"
       - ".github/workflows/apps-docs-security-deps.yml"
   pull_request:
-    paths:
-      - "apps/docs/**"
-      - ".github/workflows/apps-docs-security-deps.yml"
+    branches: [main]
   schedule:
     - cron: "23 6 * * 1"
 

.github/workflows/apps-docs-security-secrets.yml

@@ -7,9 +7,7 @@ on:
       - "apps/docs/**"
       - ".github/workflows/apps-docs-security-secrets.yml"
   pull_request:
-    paths:
-      - "apps/docs/**"
-      - ".github/workflows/apps-docs-security-secrets.yml"
+    branches: [main]
   schedule:
     - cron: "17 6 * * 1"
 

.github/workflows/apps-ui-bundle-diff.yml

@@ -20,6 +20,10 @@ permissions:
 
 jobs:
   size-diff:
+    # Dependabot PRs run with a read-only GITHUB_TOKEN, so the size-limit-action
+    # can't post the comparison comment and fails with "Parameter token or
+    # opts.auth is required". The comment isn't useful on bot bumps anyway.
+    if: github.actor != 'dependabot[bot]'
     defaults:
       run:
         working-directory: apps/ui

.github/workflows/apps-ui-security-deps.yml

@@ -7,9 +7,7 @@ on:
       - "apps/ui/**"
       - ".github/workflows/apps-ui-security-deps.yml"
   pull_request:
-    paths:
-      - "apps/ui/**"
-      - ".github/workflows/apps-ui-security-deps.yml"
+    branches: [main]
   schedule:
     - cron: "23 6 * * 1"
 

.github/workflows/apps-ui-security-sast.yml

@@ -7,9 +7,7 @@ on:
       - "apps/ui/**"
       - ".github/workflows/apps-ui-security-sast.yml"
   pull_request:
-    paths:
-      - "apps/ui/**"
-      - ".github/workflows/apps-ui-security-sast.yml"
+    branches: [main]
   schedule:
     - cron: "29 6 * * 1"
 

.github/workflows/apps-ui-security-secrets.yml

@@ -7,9 +7,7 @@ on:
       - "apps/ui/**"
       - ".github/workflows/apps-ui-security-secrets.yml"
   pull_request:
-    paths:
-      - "apps/ui/**"
-      - ".github/workflows/apps-ui-security-secrets.yml"
+    branches: [main]
   schedule:
     - cron: "17 6 * * 1"