ci: skip PR workflow runs triggered by igel-devin-ai

.github/workflows/codeql.yml

@@ -28,6 +28,12 @@ concurrency:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
+    # Same gate as the Java CI build job: PR runs sent by igel-devin-ai (Devin)
+    # are skipped; pushes by devin-ai-integration[bot] wait for maintainer
+    # approval, and a maintainer re-run passes the check. Scoped to pull_request
+    # so scheduled runs (whose actor is the workflow's last modifier) are not
+    # skipped.
+    if: github.event_name != 'pull_request' || github.actor != 'igel-devin-ai'
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
     #   - https://gh.io/supported-runners-and-hardware-resources

.github/workflows/fork-coverage.yml

@@ -20,10 +20,13 @@ permissions:
 jobs:
   codecov:
     # Only for PRs that originate from a fork (same-repo PRs upload directly in
-    # the main CI workflow, which has secrets).
+    # the main CI workflow, which has secrets). Skipped for PR runs sent by
+    # igel-devin-ai (Devin): those are skipped in the CI build itself, so no
+    # coverage artifact exists to download.
     if: >
       github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name
+      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name &&
+      github.event.workflow_run.actor.login != 'igel-devin-ai'
     runs-on: ubuntu-latest
     env:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/fork-sonar.yml

@@ -34,10 +34,13 @@ concurrency:
 
 jobs:
   sonar:
+    # Skipped for PR runs sent by igel-devin-ai (Devin): the CI build itself is
+    # skipped for that actor, so no analysis-inputs artifact exists to download.
     if: >
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name
+      github.event.workflow_run.head_repository.full_name != github.event.workflow_run.repository.full_name &&
+      github.event.workflow_run.actor.login != 'igel-devin-ai'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     environment: fork-ci

.github/workflows/maven.yml

@@ -23,6 +23,14 @@ concurrency:
 
 jobs:
   build:
+    # PR runs sent by igel-devin-ai (Devin: `opened`/`reopened` events) are
+    # skipped as neutral instead of consuming CI - later pushes are sent by
+    # devin-ai-integration[bot] and already wait for maintainer approval. A
+    # maintainer "Re-run jobs" sets github.actor to themselves, so the job then
+    # executes normally. Scoped to pull_request events only: on `schedule`
+    # events github.actor is the workflow file's last modifier, which may be
+    # igel-devin-ai itself and would wrongly skip those runs.
+    if: github.event_name != 'pull_request' || github.actor != 'igel-devin-ai'
 
     runs-on: ubuntu-latest
     timeout-minutes: 20