ci: fire lint/CodeQL on release-please PRs

[chodeus]

What

lint.yml and codeql.yml are path-filtered to **/*.py. A release-please
PR only touches .release-please-manifest.json, VERSION, and
CHANGELOG.md — none of which match that filter — so those PRs trigger
zero status checks. automerge-release.yml then enables auto-merge on
them regardless, meaning release PRs have been merging with no CI having
run at all.

This adds .release-please-manifest.json, VERSION, and each workflow's
own file to the paths: filters (mirroring how chodeus/chub's
codeql-lint.yml includes .release-please-manifest.json), so a release
PR now fires both checks like any other change.

Why this matters

Once required status checks are configured in branch protection separately,
auto-merge will actually wait on them — but only if the checks fire in the
first place. This PR is the "make CI fire" half of that; it doesn't touch
automerge-release.yml itself.

Job names (for branch-protection required-checks)

• lint.yml → job lint
• codeql.yml → job analyze
• Note: docker-publish.yml also defines jobs named lint and test
  (path-filtered to Dockerfile/scripts/**/app/**, so it still won't
  fire on a release PR) — worth being aware of if these names collide in
  the branch-protection required-checks picker.

Ref: portfolio CI-gate audit 2026-07-21.

Summary by CodeRabbit

• Chores
  • Updated automated code quality checks to run when release metadata, version information, or workflow configuration changes.
  • Ensured relevant validation workflows are triggered for both direct updates and pull requests targeting the main branch.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4b5e0330-70a3-403b-8de2-5ca19eb9ea40

📥 Commits

Reviewing files that changed from the base of the PR and between 6a4d76a and 10565f0.

📒 Files selected for processing (2)

• .github/workflows/codeql.yml
• .github/workflows/lint.yml

---

📝 Walkthrough

Walkthrough

CodeQL and lint workflow path filters now trigger on changes to release metadata, VERSION, and their own workflow files, in addition to Python files.

Changes

Workflow trigger updates

Layer / File(s)	Summary
Expand CI workflow path filters .github/workflows/codeql.yml, .github/workflows/lint.yml	Both workflows now trigger on relevant release metadata, version, and workflow file changes for push and pull_request events.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: expanding lint and CodeQL CI triggers for release-please PRs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/release-please-ci-gate

---

_{Comment @coderabbitai help to get the list of available commands.}