ci(repo): centralize path/draft gating in a per-workflow gate job

[xsahil03x]

Summary

The repo has three workflows that use on.paths filters to skip non-applicable PRs:

• legacy_version_analyze.yml
• check_db_entities.yml
• stream_flutter_workflow.yml

GitHub branch protection treats a workflow skipped by on.paths as "Expected — Waiting for status to be reported" forever — required checks hang and the PR can't merge. The official GitHub Docs fix is to move the filter to a job-level if: so skipped jobs report success.

This PR replaces each workflow's on.paths filter with a single gate job at the top that centralizes every gating decision — path filter (via dorny/paths-filter), draft state, and push-vs-PR semantics. Downstream jobs collapse to one condition:

if: needs.gate.outputs.should_run == 'true'

What's in each workflow

Workflow	What gate.should_run evaluates
legacy_version_analyze.yml	push to master ▸ or ◂ (path matches AND not draft)
check_db_entities.yml	path matches (no draft skip — the entity-modified PR comment is still useful in drafts)
stream_flutter_workflow.yml	push to master ▸ or ◂ (path matches AND not draft) — replaces the per-job draft == false repeats on analyze, format, test, build

The previous draft-build placeholder job in stream_flutter_workflow.yml is also removed — with the gate, every required check on a draft PR is skipped by should_run evaluating false and therefore reports success. The echo-one-line placeholder is no longer doing any work.

⚠️ Branch protection follow-up: if draft-build is currently listed as a required check by name, that entry needs to be removed from the branch protection rule too — otherwise the now-missing job leaves the required check stuck at "Expected — Waiting for status to be reported" on draft PRs.

Why a single gate job and not multiple workflows / merge-gatekeeper

• Single gate matches GitHub's own troubleshooting docs recommendation.
• Third-party umbrella aggregators (upsidr/merge-gatekeeper, pkgdeps/automerge-gate) are either unmaintained or too young — see review-thread notes for the comparison.
• The companion no-op workflow / paths-ignore trick clutters the Actions tab with two workflows of the same name and breaks if anyone re-runs flutterfire configure or similar tooling that overwrites the file.

Implementation notes

• The gate job runs actions/checkout@v6 before dorny/paths-filter@v3. The action uses the GitHub API on pull_request events but needs git history on push events, so the checkout is required.
• For workflows that historically ran the full suite on push to master regardless of path (legacy + stream_flutter), the gate output expression includes github.event_name == 'push' to preserve that behavior.
• Naming follows the repo's existing determine_platforms pattern from distribute_internal.yml, just shortened to gate because the output is computed (not a passthrough of filter names).

Test plan

• PR with no changes under any filter path → required checks all report success instead of hanging (this PR itself exercises the case for legacy_version_analyze)
• PR under `packages/**` → legacy_version_analyze runs, stream_flutter_workflow runs, check_db_entities runs only if stream_chat_persistence/** is touched
• PR under `sample_app/**` → stream_flutter_workflow runs; the others skip and report success
• Draft PR with relevant changes → heavy jobs skip via the gate and report success
• Push to master → all workflows run their full suite regardless of file paths (preserves prior behavior)
• Admin: confirm draft-build is not in the required-checks list of branch protection (or remove it if it is)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Refactored GitHub Actions workflows to centralize conditional execution logic with improved path-based filtering for faster CI feedback.
  • Enhanced draft pull request handling across workflows for more consistent behavior.
  • Improved workflow reliability by ensuring proper git history availability during path filter operations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b252d6c5-01f5-47a0-b31a-2900bd28c2a5

📥 Commits

Reviewing files that changed from the base of the PR and between bf1c976 and 92d6dd1.

📒 Files selected for processing (1)

• .github/workflows/stream_flutter_workflow.yml

💤 Files with no reviewable changes (1)

• .github/workflows/stream_flutter_workflow.yml

---

📝 Walkthrough

Walkthrough

Three GitHub Actions workflows were changed to centralize gating into a new gate job that runs actions/checkout@v6 then dorny/paths-filter@v3, emits a single should_run output, and causes downstream jobs to depend on needs.gate.outputs.should_run instead of prior path triggers or draft checks.

Changes

Centralized gating for CI workflows

Layer / File(s)	Summary
check_db_entities: gate and job gating .github/workflows/check_db_entities.yml	Trigger changed to unconditional pull_request; added gate job using dorny/paths-filter; check_entity_modifications now runs only when needs.gate.outputs.should_run == 'true'; minor script formatting and trailing-whitespace cleanup.
legacy_version_analyze: replace changes job with gate .github/workflows/legacy_version_analyze.yml	Replaced prior changes job with a gate job that runs actions/checkout@v6 before dorny/paths-filter and computes should_run; analyze_legacy_versions now depends on needs.gate.outputs.should_run.
stream_flutter_workflow: remove trigger paths, add gate and wire CI jobs .github/workflows/stream_flutter_workflow.yml	Removed on.pull_request.paths filtering; introduced gate job to compute should_run (handles push vs PR and draft status); analyze, format, test, and matrix build now needs: gate and use if: needs.gate.outputs.should_run == 'true'; removed draft-build.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰 I hopped into the CI glade,
Added checkout where the filters played,
One gate now speaks, a single light,
Downstream jobs wake only when it's right,
Hop, patch, test — the pipeline's bright.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and accurately summarizes the main change: centralizing path/draft gating logic into per-workflow gate jobs across three workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/legacy-analyze-checkout-fix

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/legacy_version_analyze.yml:
- Line 34: Replace the mutable action reference "uses: actions/checkout@v6" with
a pinned commit SHA for actions/checkout (e.g., actions/checkout@<commit-sha>)
and add the checkout step's input "with: persist-credentials: false" to disable
credential persistence (so update the checkout step that contains uses:
actions/checkout@v6 to use the SHA and include the persist-credentials: false
setting).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f7ce6802-31ed-481c-b196-31583105a987

📥 Commits

Reviewing files that changed from the base of the PR and between 5b8209b and 7c0b359.

📒 Files selected for processing (1)

• .github/workflows/legacy_version_analyze.yml

[coderabbitai]

Actionable comments posted: 4

🧹 Nitpick comments (1)

.github/workflows/legacy_version_analyze.yml (1)

38-39: ⚡ Quick win

Pin dorny/paths-filter to a commit SHA.

GitHub Actions best practice recommends pinning to commit SHAs for supply chain security. Update the reference from @v3 to a pinned commit SHA (e.g., @abc123...). Note: The same should apply to other unpinned action references in the workflow if this security posture is being adopted.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/legacy_version_analyze.yml around lines 38 - 39, Replace
the unpinned GitHub Action reference currently used by the "Detect Path Changes"
job (uses: dorny/paths-filter@v3) with a pinned commit SHA (e.g., uses:
dorny/paths-filter@<commit-sha>) to harden supply chain security; update the
uses value for "Detect Path Changes" and scan the workflow for any other uses:
entries that end in a tag like `@v3` and replace them with their corresponding
pinned commit SHAs.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/check_db_entities.yml:
- Around line 22-26: Update the two action usages to immutable references and
disable credential persistence: replace the mutable tags for the Checkout and
Paths Filter actions (the steps named "📥 Checkout" using actions/checkout@v6
and "🛤️ Detect Path Changes" using dorny/paths-filter@v3) with their respective
full commit SHAs, and add persist-credentials: false to the "📥 Checkout" step
so the workflow token is not written to git config.
- Around line 17-32: Add explicit workflow permissions for the jobs instead of
relying on defaults: inside the "gate" job (job id gate) add permissions: {
contents: read, pull-requests: read } to allow actions/checkout and
dorny/paths-filter to work; in the "Check entity modifications" job (the job
that runs the DB entity checks and uses peter-evans/find-comment and
peter-evans/create-or-update-comment) add permissions: { contents: read,
pull-requests: write } so checkout and PR comment creation have the required
scopes.

In @.github/workflows/legacy_version_analyze.yml:
- Around line 27-39: The gate job currently runs actions/checkout@v6 and
dorny/paths-filter@v3 without explicit token scopes; add a permissions block to
the gate job that grants only the needed permissions (e.g., contents: read for
actions/checkout and pull-requests: read for dorny/paths-filter) to follow
least-privilege practice; update the job named "gate" to include permissions: {
contents: read, pull-requests: read } so the checkout and paths-filter steps
have explicit, minimal token access.

In @.github/workflows/stream_flutter_workflow.yml:
- Around line 32-41: Update the `gate` job to harden third-party action usage:
pin the actions used in the steps named "Git Checkout" (`actions/checkout`) and
"Detect Path Changes" (`dorny/paths-filter`) to their full commit SHAs instead
of mutable tags, set the `persist-credentials: false` input on the "Git
Checkout" step, and add explicit permissions—declare `permissions: contents:
read` at the workflow level and add `pull-requests: read` to the `gate` job (or
to the step running `dorny/paths-filter`) so the paths filter only has the
minimal access it needs.

---

Nitpick comments:
In @.github/workflows/legacy_version_analyze.yml:
- Around line 38-39: Replace the unpinned GitHub Action reference currently used
by the "Detect Path Changes" job (uses: dorny/paths-filter@v3) with a pinned
commit SHA (e.g., uses: dorny/paths-filter@<commit-sha>) to harden supply chain
security; update the uses value for "Detect Path Changes" and scan the workflow
for any other uses: entries that end in a tag like `@v3` and replace them with
their corresponding pinned commit SHAs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bb5d960c-5b96-4ffc-9dc4-0f81422be5b2

📥 Commits

Reviewing files that changed from the base of the PR and between 7c0b359 and bf1c976.

📒 Files selected for processing (3)

• .github/workflows/check_db_entities.yml
• .github/workflows/legacy_version_analyze.yml
• .github/workflows/stream_flutter_workflow.yml

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.27%. Comparing base (903c77c) to head (92d6dd1).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2669   +/-   ##
=======================================
  Coverage   65.27%   65.27%           
=======================================
  Files         423      423           
  Lines       26622    26622           
=======================================
  Hits        17377    17377           
  Misses       9245     9245           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.