[Tr00d]

Why

Almost half of master's recent commits are bookkeeping: refresh sdk-compliance, refresh baseline, release and format. Each one ran the full gate with E2E, plus mutation and annotation validation, once on its PR and again after merge. None of those checks reads the files these PRs touch.

What changes

scripts/quality-gate/changed-areas.sh <base-sha> classifies the diff:

Output	True when the diff touches	Gates
code	anything but sdk-compliance.yaml, CHANGELOG.md, packages/*/.gate-baseline.json	full gate (build-and-test)
csharp	a .cs file	mutation, annotation validation, format-master, capability sync

Each workflow has a small changes job, and the heavy jobs depend on it through if:. A skipped job reports as passing.

• The skip is decided by the files, not the PR. Titles, branch names, commit messages and the PR's author are all chosen by whoever opens or merges the PR, so none of them decides a skip. A diff that only touches sdk-compliance.yaml cannot break the build, whoever wrote it.

• An unknown range runs everything. That covers an empty diff, a base the runner can't find, and a manual dispatch.

• Fewer format PRs. Only PRs from forks pass --bypass-format now (head.repo.full_name != github.repository). PRs from this repo's own branches (maintainers, agents, release-please, bots) must pass the format check before merge, so format-master rarely has anything to commit.

• Commit-message skips are gone. They let any change titled that way skip formatting or the sync:

  Workflow	Skipped before	Skips now
  format-master	any commit starting chore(format) or chore(quality-gate)	when no .cs file changed
  capability-matrix-sync	any commit starting chore(	when no .cs file changed

  capability-matrix-sync also gains workflow_dispatch, so a change to the canonical spec in supabase/sdk, which never pushes here, can be picked up.

Effect per PR type

PR	Before	After
Capability sync	full gate + E2E, mutation, validation; again on merge	changes only; merge: nothing heavy
Baseline refresh	same	same as capability sync
Release (CHANGELOG, manifest, *.csproj)	full gate, mutation, validation	full gate only. A .csproj change can break the build, and release.yml waits on build-and-test before publishing
Mark API shipped (PublicAPI.*.txt)	full gate, mutation, validation	full gate only. The analyzer reads those files
Feature	unchanged	unchanged

Known edge

On master, runs of the same workflow still cancel each other, as before. Suppose a bookkeeping push lands right after a code push and cancels the code push's master run. That code push then gets no post-merge gate run or capability sync until the next code merge.

That's acceptable:

• The code was already gated on its PR.
• The baseline refresh and the sync both regenerate from the whole tree, so the next code merge catches up.
• A release commit always counts as code, so it always runs the gate.

Verification

• scripts/quality-gate/fixtures-changed-areas/run.sh: 15/15 cases. Each one commits files into a throwaway repository and checks the classification, covering every rule plus an empty, all-zero or unknown base.
• Workflow YAML parses. actionlint isn't available locally.
• This PR's own CI exercises the PR path. The push path (skipped master runs) only runs after merge.

The baseline-loosening check and the coverage-ratchet fix moved to #615. Neither PR depends on the other.