Ci/bump shared workflows

.github/workflows/auto-merge.yml

@@ -11,5 +11,5 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit

.github/workflows/bump-release.yml

@@ -31,7 +31,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     with:
       bump-type: ${{ inputs.bump-type }}
       tag-message-title: ${{ inputs.tag-message-title }}

.github/workflows/codeql.yml

@@ -18,5 +18,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit

.github/workflows/contributors.yml

@@ -14,5 +14,5 @@ jobs:
     permissions:
       pull-requests: write
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit

.github/workflows/go-test.yml

@@ -13,5 +13,12 @@ on:
 
 jobs:
   test:
-    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
+    with:
+      # From v0.5.0 the shared workflow skips the matrix when nothing relevant changed, and
+      # what it watches is go sources. Ours are not the whole input: the integration tests
+      # compare against captured specs under fixtures/integration/golden, and a corpus that
+      # moves without a line of go moving is exactly the change those tests exist to catch.
+      extra-paths: |
+        fixtures/**
     secrets: inherit

.github/workflows/monitor-bot-pr.yml

@@ -14,5 +14,5 @@ jobs:
       contents: write
       pull-requests: write
       statuses: read
-    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit

.github/workflows/scanner.yml

@@ -15,5 +15,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     secrets: inherit

.github/workflows/tag-release.yml

@@ -13,7 +13,7 @@ jobs:
     name: Create release
     permissions:
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/release.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/release.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     with:
       tag: ${{ github.ref_name }}
       is-monorepo: 'true'

.github/workflows/update-doc.yml

@@ -3,21 +3,17 @@ name: "Update documentation"
 permissions:
   contents: read
 
+# NOTE: no "paths" filter here, on purpose. A workflow filtered out by its paths never
+# starts, so it reports no status at all — fine while nothing waits on it, useless the day
+# the doc build is pinned in the branch protection rules. Filtering happens in the
+# "changes" job below, which fails open, so the build is skipped rather than never run.
 on:
   push:
     tags:
       - v*
     branches: [ "master" ]
-    paths:
-    - docs/**
-    - hack/doc-site/**
-    - .github/workflows/update-doc.yml
 
   pull_request:
-    paths:
-    - docs/**
-    - hack/doc-site/**
-    - .github/workflows/update-doc.yml
 
 concurrency:
   group: "pages"
@@ -28,7 +24,32 @@ defaults:
     shell: bash
 
 jobs:
+  changes:
+    # description: |
+    #   Is there anything here to publish? Fails open: anything unclear rebuilds the site.
+    #
+    #   A tag push lands in that fail-open branch — a freshly created tag has no previous
+    #   commit to compare against — which is what we want, since the rendered pages carry
+    #   the latest release.
+    name: Changes
+    permissions:
+      contents: read
+      # A called workflow cannot hold more than its caller grants, and an omitted scope
+      # is 'none': without this the run is rejected before it starts.
+      pull-requests: read
+    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
+    with:
+      preset: doc
+      # The preset knows the go-openapi layout — markdown anywhere, the hugo tree under
+      # hack/doc-site — but not that this repo keeps reference pages under docs/, nor that
+      # a change to this file changes what gets published.
+      extra-paths: |
+        docs/**
+        .github/workflows/update-doc.yml
+
   build-doc:
+    needs: [ changes ]
+    if: ${{ needs.changes.outputs.changed == 'true' }}
     runs-on: ubuntu-latest
     steps:
       -

.github/workflows/webhook-announcements.yml

@@ -50,7 +50,7 @@ on:
 
 jobs:
   announce:
-    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
+    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@81c95ab8bb6a3e0aeccc90a7c9e5fc5b398b1244 # v0.6.0
     with:
       scanned-markdown: README.md
       # On push: normal before..after diff (empty