ci: retry the changes filter so one dropped API connection does not fail every check

[iscekic]

Why

The changes job runs dorny/paths-filter to decide which checks are needed. That action has no retry of its own, so a single dropped connection to api.github.com while it lists a pull request's changed files fails the step — and with it every check that declares needs: changes.

Observed on PR #5925 (2026-09-07): the changes job failed, typecheck, lint, build, test and the rest never ran, and the pull request could not go green until the job was re-run by hand.

What changed

• The first Detect changes attempt is continue-on-error: true, and a second Detect changes (retry) step runs only if: steps.filter.outcome == 'failure'.
• The job's kilocode_backend and cloud_agent_next outputs fall back to the retry's outputs. Every consumer reads them through needs.changes.outputs, so no other step needs a change.
• A persistent failure still fails the job: the retry step is not continue-on-error.
• scripts/changes-filter-retry.test.mjs fails the job if the wiring rots. It rejects a retry that is unconditional, filters that drift between the two attempts, a missing output fallback, and an ignored retry outcome. It runs in the same job, before the filter steps.

Proof

$ node --test scripts/changes-filter-retry.test.mjs
✔ changes rejects ignored-retry
✔ changes rejects unconditional-retry
✔ changes rejects drifted-filters
✔ changes rejects missing-fallback
ℹ tests 7  pass 7  fail 0

The changes job on this pull request is the live proof of the happy path: it runs the new test and both filter steps.

Scope

workspace_matrix comes from a separate Detect changed workspaces with tests step, which is not retried. A transient failure there still fails the job.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• .github/workflows/ci.yml
• scripts/changes-filter-retry.test.mjs

---

_{Reviewed by grok-4.6 · Input: 77.2K · Output: 11K · Cached: 235K}

_{Review guidance: REVIEW.md from base branch main}