docs: trim README release history and skip unused PR CI lanes

.github/workflows/ci.yml

@@ -20,6 +20,7 @@ jobs:
     timeout-minutes: 5
     outputs:
       node_compat: ${{ steps.scope.outputs.node_compat }}
+      windows_authority: ${{ steps.scope.outputs.windows_authority }}
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -33,7 +34,7 @@ jobs:
           node-version: 24
           package-manager-cache: false
 
-      - name: Detect Node compatibility scope
+      - name: Detect CI scope
         id: scope
         shell: bash
         env:
@@ -43,6 +44,7 @@ jobs:
           set -euo pipefail
           if [[ "${EVENT_NAME}" != "pull_request" ]]; then
             echo "node_compat=true" >> "${GITHUB_OUTPUT}"
+            echo "windows_authority=true" >> "${GITHUB_OUTPUT}"
             exit 0
           fi
 
@@ -111,9 +113,17 @@ jobs:
 
   windows-authority:
     name: Node 24 / windows-latest
+    needs: scope
+    if: always() && (needs.scope.result != 'success' || github.event_name != 'pull_request' || needs.scope.outputs.windows_authority == 'true')
     runs-on: windows-latest
     timeout-minutes: 25
     steps:
+      - name: Fail closed when scope detection failed
+        if: needs.scope.result != 'success'
+        run: |
+          echo "::error::Detect CI scope did not complete successfully."
+          exit 1
+
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/codeql.yml

@@ -16,15 +16,67 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  scope:
+    name: Detect CodeQL scope
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      javascript: ${{ steps.scope.outputs.javascript }}
+      csharp: ${{ steps.scope.outputs.csharp }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Node.js 24
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          package-manager-cache: false
+
+      - name: Detect CodeQL scope
+        id: scope
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          if [[ "${EVENT_NAME}" != "pull_request" ]]; then
+            echo "javascript=true" >> "${GITHUB_OUTPUT}"
+            echo "csharp=true" >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+
+          TRUSTED_SCOPE="${RUNNER_TEMP}/github-delivery-ci-scope-base.mjs"
+          git show "${BASE_SHA}:scripts/ci-scope.mjs" > "${TRUSTED_SCOPE}"
+          if git diff --name-only -z "${BASE_SHA}"...HEAD |
+            node "${TRUSTED_SCOPE}" --mode codeql >> "${GITHUB_OUTPUT}"; then
+            exit 0
+          fi
+          echo "::warning::Base CI scope classifier does not support CodeQL mode; fail-closed to running both analyses."
+          echo "javascript=true" >> "${GITHUB_OUTPUT}"
+          echo "csharp=true" >> "${GITHUB_OUTPUT}"
+
   analyze:
     name: CodeQL / Analyze (javascript-typescript)
+    needs: scope
+    if: always() && (needs.scope.result != 'success' || github.event_name != 'pull_request' || needs.scope.outputs.javascript == 'true')
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
       contents: read
       packages: read
       security-events: write
     steps:
+      - name: Fail closed when scope detection failed
+        if: needs.scope.result != 'success'
+        run: |
+          echo "::error::Detect CodeQL scope did not complete successfully."
+          exit 1
+
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -45,13 +97,21 @@ jobs:
 
   analyze-csharp:
     name: CodeQL / Analyze (csharp)
+    needs: scope
+    if: always() && (needs.scope.result != 'success' || github.event_name != 'pull_request' || needs.scope.outputs.csharp == 'true')
     runs-on: windows-latest
     timeout-minutes: 30
     permissions:
       contents: read
       packages: read
       security-events: write
     steps:
+      - name: Fail closed when C# scope detection failed
+        if: needs.scope.result != 'success'
+        run: |
+          echo "::error::Detect CodeQL scope did not complete successfully."
+          exit 1
+
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/windows-rewrite-baseline.yml

@@ -2,9 +2,19 @@ name: Windows rewrite baseline
 
 on:
   pull_request:
+    paths:
+      - "scripts/lib/rewrite-baseline-store.mjs"
+      - "scripts/lib/github-lifecycle-mutation-broker.mjs"
+      - "tests/unit/push-cleanup-convergence.test.mjs"
+      - ".github/workflows/windows-rewrite-baseline.yml"
   push:
     branches:
       - main
+    paths:
+      - "scripts/lib/rewrite-baseline-store.mjs"
+      - "scripts/lib/github-lifecycle-mutation-broker.mjs"
+      - "tests/unit/push-cleanup-convergence.test.mjs"
+      - ".github/workflows/windows-rewrite-baseline.yml"
 
 permissions:
   contents: read

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to `github-delivery` are documented here.
 
 ## [Unreleased]
 
+### Changed
+
+- README current-state now keeps only the documented fail-closed limits and the still-expanding list, and release notes point at `CHANGELOG.md` instead of duplicating version history.
+- Pull-request Windows Authority, JavaScript CodeQL, and C# CodeQL jobs now run only when the trusted base-SHA path classifier says those lanes are in scope. Scope detection failure still fail-closes into running the lane. The Windows rewrite-baseline workflow is path-filtered to the files it exercises.
+
 ## [1.3.8] - 2026-08-30
 
 ### Changed