fix: skip automated PR when no doc content changes

[sonupreetam]

Summary

Addresses review feedback from @marcusburghardt on PR #8: the weekly content-sync workflow was opening automated PRs even when no documentation files changed — only the lockfile SHA differed. This made the content approval gate noisy and easy to rubber-stamp.

• Splits the single workflow step into two: --update-lock (writes new SHAs to .content-lock.json) then --write (syncs doc content with the new lock, captures has_changes)
• Guards the "Create or update PR" step with if: steps.check.outputs.has_changes == 'true' — PR is skipped when all docs are unchanged
• Fixes syncResult.hasChanges() to include file-level doc changes (changedRepoFiles) in addition to repo-level project-page changes — previously a repo whose README was unchanged but whose doc sub-pages had new content would emit has_changes=false

OpenSpec

openspec/changes/skip-lockfile-only-pr/ — full spec-driven artifact set:

• proposal.md — why and what changes
• specs/pr-noise-reduction/spec.md — workflow gate requirements
• specs/content-change-detection/spec.md — hasChanges() contract
• design.md — key decisions and trade-offs
• tasks.md — 6/6 complete

Also initialises OpenSpec v1.2.0 with Cursor tooling (.cursor/commands/, .cursor/skills/).

Files changed

File	Change
.github/workflows/sync-content-check.yml	Two-step check, if: guard on PR step
cmd/sync-content/sync.go	hasChanges() includes changedRepoFiles
cmd/sync-content/sync_test.go	7-subtest TestHasChanges table

Test plan

• go test -race ./cmd/sync-content/... -run TestHasChanges — all 7 subtests pass
• go test -race ./cmd/sync-content/... — full suite passes
• Workflow: when all docs unchanged, "Create or update PR" step is skipped
• Workflow: when docs change, PR is created with accurate summary

Made with Cursor

[marcusburghardt]

MEDIUM: content/ in add-paths will be a no-op: the main branch .gitignore already contains content/docs/projects/*/, and peter-evans/create-pull-request respects .gitignore by default — so git add content/ won't stage any synced doc files.

If the intent (IMP-005) is to show doc-file diffs in the automated PR, the .gitignore rule for content/docs/projects/*/ would also need to be relaxed. Otherwise, consider removing content/ from add-paths to avoid confusion.

[marcusburghardt]

LOW: ${{ steps.check.outputs.changed_repos }} is interpolated directly into the shell script before bash executes. While GitHub repo names are restricted to [a-zA-Z0-9._-] making injection impractical here, the safer pattern is to pass the value via an environment variable:

env:
  CHANGED_REPOS: ${{ steps.check.outputs.changed_repos }}
run: |
  IFS=',' read -ra repos <<< "$CHANGED_REPOS"

See: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable

[sonupreetam]

@marcusburghardt Thank you for you feedbacks. I have removed the content/, it no-op you are right. And took care of the other through pass the value via an environment variable.