From 4910f39d41929d345cfcd2b30fdcdecebdf4f5c5 Mon Sep 17 00:00:00 2001
From: Sam Crauwels <sam.crauwels@gmail.com>
Date: Thu, 5 Mar 2026 22:30:07 +0100
Subject: [PATCH] Make full_stack_gate run on every PR with path-based skip

The full_stack_gate required check blocked PRs that didn't touch
full-stack paths because the workflow never triggered. Now the workflow
triggers on all PRs but uses dorny/paths-filter to skip the heavy
molecule jobs when no relevant files changed. The gate job always runs
and reports success for unrelated PRs.

Schedule, workflow_dispatch, and merge_group triggers bypass the filter
and always run the full test suite.
---
 .github/workflows/test_full_stack.yml | 41 ++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/test_full_stack.yml b/.github/workflows/test_full_stack.yml
index 19e57326..b42d92d6 100644
--- a/.github/workflows/test_full_stack.yml
+++ b/.github/workflows/test_full_stack.yml
@@ -13,15 +13,6 @@ on:
           - warning
           - debug
   pull_request:
-    paths:
-      - 'roles/elasticstack/**'
-      - 'molecule/elasticstack_*/**'
-      - 'molecule/es_kibana/**'
-      - 'molecule/logstash_elasticsearch/**'
-      - 'molecule/cert_renewal/**'
-      - 'molecule/shared/**'
-      - 'plugins/**'
-      - '.github/workflows/test_full_stack.yml'
   merge_group:
   schedule:
     - cron: "0 4 * * *"
@@ -34,7 +25,29 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      should_test: ${{ steps.filter.outputs.should_test }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: filter
+        with:
+          filters: |
+            should_test:
+              - 'roles/elasticstack/**'
+              - 'molecule/elasticstack_*/**'
+              - 'molecule/es_kibana/**'
+              - 'molecule/logstash_elasticsearch/**'
+              - 'molecule/cert_renewal/**'
+              - 'molecule/shared/**'
+              - 'plugins/**'
+              - '.github/workflows/test_full_stack.yml'
+
   lint_full:
+    needs: changes
+    if: needs.changes.outputs.should_test == 'true' || github.event_name != 'pull_request'
     uses: ./.github/workflows/test_linting.yml
     with:
       rolename: ''
@@ -42,7 +55,8 @@ jobs:
 
   molecule_full_stack_every_os:
     runs-on: self-hosted
-    needs: lint_full
+    needs: [changes, lint_full]
+    if: needs.changes.outputs.should_test == 'true' || github.event_name != 'pull_request'
     timeout-minutes: 120
 
     env:
@@ -177,11 +191,16 @@ jobs:
 
   full_stack_gate:
     runs-on: ubuntu-latest
-    needs: [lint_full, molecule_full_stack_every_os]
+    needs: [changes, lint_full, molecule_full_stack_every_os]
     if: always()
     steps:
       - name: Check results
         run: |
+          # If no relevant files changed, tests were skipped — that's OK
+          if [[ "${{ needs.changes.outputs.should_test }}" != "true" && "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "No relevant changes — skipping full stack gate"
+            exit 0
+          fi
           if [[ "${{ needs.lint_full.result }}" != "success" ]] || \
              [[ "${{ needs.molecule_full_stack_every_os.result }}" != "success" ]]; then
             echo "Required jobs failed"