From 988f8976e1cb3a60178ce6ac76938cd3a83eaaf1 Mon Sep 17 00:00:00 2001
From: Brian Kane <briankane1@gmail.com>
Date: Thu, 6 Aug 2026 13:13:40 +0100
Subject: [PATCH] Chore: skip image, license, definition and webhook checks on
 docs-only PRs (#7293)

unit-test, e2e-test, e2e-multicluster-test and go already gate their jobs on a
detect-noop step, so a pull request touching only markdown skips them. Four
workflows were never given the same treatment and still run in full:

  definition-lint.yml              definition-doc
  license.yml                      license_check
  trivy-scan.yml                   images (Image Scan)
  webhook-upgrade-validation.yml   webhook-upgrade-check

On a docs-only PR that is a container build and a Trivy scan, a Ruby toolchain
and a licence sweep, a definition doc generation, and a webhook upgrade check -
none of which can be affected by a markdown change.

This copies the existing pattern verbatim rather than inventing one: the same
pinned fkirc/skip-duplicate-actions SHA, the same paths_ignore and do_not_skip,
the same `needs`/`if` gating on the job. Purely additive - 72 lines, no
deletions, no change to what any job does when it runs.

Gating the job rather than filtering the trigger is deliberate and matches the
existing workflows. A workflow that never triggers reports no status at all, so a
required check would sit at "Expected" and block the merge; a job skipped via
`if:` reports "Skipped", which branch protection accepts.

Signed-off-by: Brian Kane <briankane1@gmail.com>
---
 .github/workflows/definition-lint.yml          | 18 ++++++++++++++++++
 .github/workflows/license.yml                  | 18 ++++++++++++++++++
 .github/workflows/trivy-scan.yml               | 18 ++++++++++++++++++
 .../workflows/webhook-upgrade-validation.yml   | 18 ++++++++++++++++++
 4 files changed, 72 insertions(+)

diff --git a/.github/workflows/definition-lint.yml b/.github/workflows/definition-lint.yml
index bdfa61c0d..b5629ccf7 100644
--- a/.github/workflows/definition-lint.yml
+++ b/.github/workflows/definition-lint.yml
@@ -19,7 +19,25 @@ env:
   GO_VERSION: '1.23.8'
 
 jobs:
+  detect-noop:
+    permissions:
+      actions: write # for fkirc/skip-duplicate-actions to skip or stop workflow runs
+    runs-on: ubuntu-22.04
+    outputs:
+      noop: ${{ steps.noop.outputs.should_skip }}
+    steps:
+      - name: Detect No-op Changes
+        id: noop
+        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
+          do_not_skip: '["workflow_dispatch", "schedule", "push"]'
+        continue-on-error: true
+
   definition-doc:
+    needs: detect-noop
+    if: needs.detect-noop.outputs.noop != 'true'
     runs-on: ubuntu-22.04
     steps:
       - name: Setup Go
diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
index faf91b0a5..1e37f94ea 100644
--- a/.github/workflows/license.yml
+++ b/.github/workflows/license.yml
@@ -13,7 +13,25 @@ permissions:
   contents: read
 
 jobs:
+  detect-noop:
+    permissions:
+      actions: write # for fkirc/skip-duplicate-actions to skip or stop workflow runs
+    runs-on: ubuntu-22.04
+    outputs:
+      noop: ${{ steps.noop.outputs.should_skip }}
+    steps:
+      - name: Detect No-op Changes
+        id: noop
+        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
+          do_not_skip: '["workflow_dispatch", "schedule", "push"]'
+        continue-on-error: true
+
   license_check:
+    needs: detect-noop
+    if: needs.detect-noop.outputs.noop != 'true'
     runs-on: ubuntu-22.04
     name: Check for unapproved licenses
     steps:
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index 12d566b40..6fc685e7c 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -8,7 +8,25 @@ permissions:
   contents: read
 
 jobs:
+  detect-noop:
+    permissions:
+      actions: write # for fkirc/skip-duplicate-actions to skip or stop workflow runs
+    runs-on: ubuntu-22.04
+    outputs:
+      noop: ${{ steps.noop.outputs.should_skip }}
+    steps:
+      - name: Detect No-op Changes
+        id: noop
+        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
+          do_not_skip: '["workflow_dispatch", "schedule", "push"]'
+        continue-on-error: true
+
   images:
+    needs: detect-noop
+    if: needs.detect-noop.outputs.noop != 'true'
     name: Image Scan
     runs-on: ubuntu-22.04
     steps:
diff --git a/.github/workflows/webhook-upgrade-validation.yml b/.github/workflows/webhook-upgrade-validation.yml
index 5e8bceb1f..b674c059a 100644
--- a/.github/workflows/webhook-upgrade-validation.yml
+++ b/.github/workflows/webhook-upgrade-validation.yml
@@ -20,7 +20,25 @@ env:
   GO_VERSION: '1.23.8'
 
 jobs:
+  detect-noop:
+    permissions:
+      actions: write # for fkirc/skip-duplicate-actions to skip or stop workflow runs
+    runs-on: ubuntu-22.04
+    outputs:
+      noop: ${{ steps.noop.outputs.should_skip }}
+    steps:
+      - name: Detect No-op Changes
+        id: noop
+        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          paths_ignore: '["**.md", "**.mdx", "**.png", "**.jpg"]'
+          do_not_skip: '["workflow_dispatch", "schedule", "push"]'
+        continue-on-error: true
+
   webhook-upgrade-check:
+    needs: detect-noop
+    if: needs.detect-noop.outputs.noop != 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps: