ci: a workflow-only pull request can pass the required check without running any tests

Summary

detect-changes in build_and_test.yml decides whether to run the build, unit and e2e jobs by grepping the changed-file list for ^(packages/|package\.json|bun\.lock|bunfig\.toml). A pull request that touches only .github/ matches nothing, so packages is false and every downstream job is skipped.

all-passed runs with if: always() and its only step is:

- run: exit ${{ (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) && 1 || 0 }}

A skipped need is neither failure nor cancelled, so all-passed reports success. all-passed is the only required check on master, minor and major.

The result: a workflow-only pull request can show a green required check having compiled and tested nothing.

Why it has not bitten yet

detect-changes computes its range from git merge-base "$base" HEAD, where $base is github.event.pull_request.base.sha — the base commit recorded when the pull request was opened, not the current tip.

PR #5231 is workflow-only and did run full CI. Its base.sha dates from 2026-09-01, so the merge-base range contained 155 files, 104 of which matched the grep. All of them were unrelated master commits pulled in by the age of the branch, not the pull request's own work.

So the protection currently in place is that a branch is old enough for master to have drifted. A workflow-only pull request opened against a fresh master tip would skip everything.

Suggested fix

Either add .github/ to the grep with a job that runs the workflow scripts' own tests, or make all-passed fail on skipped as well when the trigger is pull_request. The second is the smaller change and closes the general case rather than one path.

Related

Found while verifying #5231 in a merge-lane session. That pull request adds .github/workflows/scripts/dependency-impact.test.js, 265 lines of tests which have never executed in CI for this same reason.