[napetrov]

Summary

Fewer CI jobs on each PR push. Test coverage on main is unchanged.

 ci.yml (pull_request)
   Tests:          3.11  3.12  3.13  3.14(cov)
-                  4 legs
+                  3.11, 3.14(cov)        # 3.12/3.13 still on push to main, weekly, dispatch
   package-smoke:
-                  3.11  3.13
+                  3.11                   # 3.13 still on push to main, weekly, dispatch
   test legs checkout:
-                  fetch-depth 0 on every leg
+                  fetch-depth 0 on the coverage leg only (diff-cover)

 codeql.yml       PR → only when **.py / .github/workflows|actions change
 docs.yml         PR → skipped when only tests/, changelog fragments, other workflows change
 cli-interface    PR → only when dokimi/dokimi/**, cli.py, cli_surface.py, lock change
                  (cli-interface-comment, its workflow_run follower, drops with it)
-docs-review-triggers.yml     (own runner)
+changelog.yml: fragment job also runs the docs review triggers step

The matrix cut uses conditional exclude: entries ('3.12' on a PR, 'none' otherwise), not a computed list: scripts/ci_local.py reads python-version as a list.

The path filters are workflow-level. No status check is required on main (rulesets: deletion, non-FF, PR, Copilot review only), so a filtered-out workflow blocks no merge.

Not included:

• Skipping ci.yml on docs-only PRs: ~100 test files read .md files, and twine check --strict renders the README, so a docs-only change can still fail CI.
• gitleaks is unchanged: the PR run scans the PR's commits and the main run scans full history, so they don't overlap.

Evidence

• scripts/ci_local.py: ci_pythons() still returns ('3.13', ['3.11','3.12','3.13','3.14']), and run --offline --jobs fragment runs both steps, fragment and docs pages: 2 passed.
• zizmor --offline --min-severity medium .github/workflows: no findings.
• actionlint: no findings in the changed files (2 existing alias warnings in conda-forge/pip-audit).
• Full suite on 3.13: 7742 passed, 23 skipped. pre-commit (CI's SKIP set): pass.
• This PR's own checks show the reduced set: Tests 3.11 + 3.14 only, package-smoke 3.11 only.

Merge Danger

Door: two-way

Revert the commit to restore the old triggers.

Blast Radius: CI-only

• A failure that shows on 3.12 or 3.13 alone now surfaces on main after merge, not on the PR.
• A docs build broken by a test-only PR is caught on main.
• The docs-review-triggers check name no longer exists; it is now a step of the changelog check.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.97%. Comparing base (be15dd9) to head (45800e2).
⚠️ Report is 3 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #207      +/-   ##
==========================================
- Coverage   91.98%   91.97%   -0.01%     
==========================================
  Files         223      223              
  Lines       27743    27743              
  Branches     4560     4560              
==========================================
- Hits        25520    25518       -2     
- Misses       1574     1575       +1     
- Partials      649      650       +1     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[xaleryb]

Ran the full suite and ruff on Linux at 45800e2: 7744 passed, clean. Merges cleanly with #208. Checked that no page built into the site links into tests/ or .github/, so the docs filter skips nothing the strict build reads.

• cli-interface.yml, lines 15-18: for pull_request, paths is matched against the PR's diff with its base as it is now. A PR that changes dokimi/cli.py, gets cli-interface-change, and then reverts that file no longer matches, so the workflow does not run and the label and comment stay. Either say so in the comment (the label is then removed by hand), or drop the filter for this workflow.