From ea41c7f3fc6137c1b0a5cabb1455ad03f6cc6e1b Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Mon, 11 May 2026 01:18:45 +0300
Subject: ci(ai-validation): hoist has_md_changes gate to validate job level
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per Copilot review on PR #1968: with the per-step gates, the validate
job still ran the expensive setup chain (artifact download, GitHub App
token, reviewer checkout/install, reference-DB download/extract, uv
setup) on infrastructure-only PRs even though both Pass 1 and Pass 2
were guaranteed to skip. CI minutes wasted, no value produced.

Move the gate to the job level — `if: needs.prepare.outputs.has_md_changes
== 'true'` on validate. The whole job (including setup) skips cleanly
when no .md files changed, and the per-step gates become redundant
(removed in the same commit).

🤖 Generated by [robots](https://vyos.io)
---
 .github/workflows/ai-validation.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ai-validation.yml b/.github/workflows/ai-validation.yml
index c6d7c664..5319023e 100644
--- a/.github/workflows/ai-validation.yml
+++ b/.github/workflows/ai-validation.yml
@@ -151,6 +151,11 @@ jobs:
 
   validate:
     needs: [prepare]
+    # Skip the entire job on infrastructure-only PRs. Otherwise the
+    # expensive setup chain (artifact download, GitHub App token, reviewer
+    # checkout/install, reference-DB download/extract, uv setup) runs even
+    # though Pass 1 + Pass 2 are guaranteed to no-op.
+    if: needs.prepare.outputs.has_md_changes == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -329,7 +334,7 @@ jobs:
       # Pass 1 would emit zero findings — a silent failure mode the
       # §3.6 fail-closed gate cannot catch when the DB is present.
       - name: Pass 1 — deterministic checks
-        if: steps.secrets-check.outputs.skip != 'true' && steps.download-db.outcome == 'success' && needs.prepare.outputs.has_md_changes == 'true'
+        if: steps.secrets-check.outputs.skip != 'true' && steps.download-db.outcome == 'success'
         working-directory: _changed_md
         run: |
           vyos-doc-review pass1 \
@@ -338,7 +343,7 @@ jobs:
             --output ../pass1-findings.json
 
       - name: Pass 2 — Claude review
-        if: steps.secrets-check.outputs.skip != 'true' && needs.prepare.outputs.has_md_changes == 'true'
+        if: steps.secrets-check.outputs.skip != 'true'
         uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-- 
cgit v1.2.3