From 6292cc43874f1b90b1be466f09261cc530124b5d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 12:05:33 +0900
Subject: [PATCH 1/5] fix(ci): skip docs-only changes for ci, reviewer-ci,
 patch-validator-image

Org-wide CI audit found these workflows lack paths-ignore, triggering full
CI on every docs-only push/PR and contributing to org Actions queue backlog.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml                    | 6 ++++++
 .github/workflows/patch-validator-image.yml | 3 +++
 .github/workflows/reviewer-ci.yml           | 6 ++++++
 3 files changed, 15 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d83efcc04..4e05addb1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,9 +2,15 @@ name: ci
 
 on:
   pull_request:
+    paths-ignore:
+      - "docs/**"
+      - "*.md"
   push:
     branches:
       - main
+    paths-ignore:
+      - "docs/**"
+      - "*.md"
 
 concurrency:
   group: noema-ci-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/patch-validator-image.yml b/.github/workflows/patch-validator-image.yml
index 89ed4139b..bc270452e 100644
--- a/.github/workflows/patch-validator-image.yml
+++ b/.github/workflows/patch-validator-image.yml
@@ -2,6 +2,9 @@ name: patch-validator-image
 
 on:
   pull_request:
+    paths-ignore:
+      - "docs/**"
+      - "*.md"
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/reviewer-ci.yml b/.github/workflows/reviewer-ci.yml
index f5212251a..13aa6b169 100644
--- a/.github/workflows/reviewer-ci.yml
+++ b/.github/workflows/reviewer-ci.yml
@@ -2,9 +2,15 @@ name: reviewer-ci
 
 on:
   pull_request:
+    paths-ignore:
+      - "docs/**"
+      - "*.md"
   push:
     branches:
       - main
+    paths-ignore:
+      - "docs/**"
+      - "*.md"
 
 concurrency:
   group: noema-reviewer-ci-${{ github.event.pull_request.number || github.ref }}

From fa4bb2bfc714d88a189a0bc37840c488c604ce7b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 12:31:10 +0900
Subject: [PATCH 2/5] test(ci): reject docs-only verification suppression

---
 test/ci-exact-head-contract.test.ts | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/test/ci-exact-head-contract.test.ts b/test/ci-exact-head-contract.test.ts
index 7112b158d..82a00e724 100644
--- a/test/ci-exact-head-contract.test.ts
+++ b/test/ci-exact-head-contract.test.ts
@@ -6,8 +6,13 @@ const workflowPaths = [
   ".github/workflows/reviewer-ci.yml",
 ] as const;
 
+const requiredVerificationWorkflowPaths = [
+  ...workflowPaths,
+  ".github/workflows/patch-validator-image.yml",
+] as const;
+
 /** Read one authoritative pull-request verification workflow as plain text. */
-function readWorkflow(path: (typeof workflowPaths)[number]): string {
+function readWorkflow(path: string): string {
   return readFileSync(path, "utf8");
 }
 
@@ -107,4 +112,11 @@ describe("pull-request verification exact-head checkout contract", () => {
       "- name: install (hash-pinned dependencies)",
     );
   });
+
+  it("does not suppress required exact-head evidence for documentation-only changes", () => {
+    for (const path of requiredVerificationWorkflowPaths) {
+      const workflow = readWorkflow(path);
+      expect(workflow).not.toContain("paths-ignore:");
+    }
+  });
 });

From def52aadc50cd3feb779982070173209410dc1b1 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 12:31:55 +0900
Subject: [PATCH 3/5] fix(ci): keep application verification mandatory for
 docs-only changes

---
 .github/workflows/ci.yml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4e05addb1..d83efcc04 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,15 +2,9 @@ name: ci
 
 on:
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
   push:
     branches:
       - main
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
 
 concurrency:
   group: noema-ci-${{ github.event.pull_request.number || github.ref }}

From 6bc6e590c4f0ba4d951fb157ab1a6270085e967f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 12:32:20 +0900
Subject: [PATCH 4/5] fix(ci): keep reviewer verification mandatory for
 docs-only changes

---
 .github/workflows/reviewer-ci.yml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.github/workflows/reviewer-ci.yml b/.github/workflows/reviewer-ci.yml
index 13aa6b169..f5212251a 100644
--- a/.github/workflows/reviewer-ci.yml
+++ b/.github/workflows/reviewer-ci.yml
@@ -2,15 +2,9 @@ name: reviewer-ci
 
 on:
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
   push:
     branches:
       - main
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
 
 concurrency:
   group: noema-reviewer-ci-${{ github.event.pull_request.number || github.ref }}

From 60b83339cd53c639c28d4f1881d1ef4501e38534 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 3 Sep 2026 12:33:56 +0900
Subject: [PATCH 5/5] fix(ci): keep image verification mandatory for docs-only
 changes

---
 .github/workflows/patch-validator-image.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/patch-validator-image.yml b/.github/workflows/patch-validator-image.yml
index bc270452e..89ed4139b 100644
--- a/.github/workflows/patch-validator-image.yml
+++ b/.github/workflows/patch-validator-image.yml
@@ -2,9 +2,6 @@ name: patch-validator-image
 
 on:
   pull_request:
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
   workflow_dispatch:
 
 concurrency: