Improve CI: PR tests only affected features, 60-min timeout, least-privilege token

[Copilot]

Every PR was triggering the full test matrix (all features × all base images), making CI slow and noisy. The full suite should only run on merges to main.

Changes

• get-changed-features job: New preflight job that drives the test matrix dynamically.

  • On pull_request: diffs origin/<base>...HEAD, extracts changed src/ and test/ subdirectory names, outputs them as a JSON array.
  • On push/workflow_dispatch: scans ls src/ at runtime — no hardcoded feature list to drift out of sync.
  • Emits both features (JSON array) and has-features (boolean) outputs.

• Dynamic matrix for test-autogenerated and test-scenarios: Both jobs now needs: get-changed-features and use fromJson(needs.get-changed-features.outputs.features) as their matrix. Jobs are skipped entirely when has-features is false (e.g., workflow-only or docs PRs).

• timeout-minutes: 60 added to all three test jobs (test-autogenerated, test-scenarios, test-global).

• permissions: contents: read added at the workflow level — restricts GITHUB_TOKEN to the minimum required scope.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Improve Actions workflow</issue_title>
<issue_description>Situation right now:

• Full test suite runs on each Pull Request
• Full tests suite runs on each merge to main
• No timeout

Desired situation:

• Pull Requests run ONLY the tests for the affected feature
• Merge on main still runs the entire test suite
• Entire test suite should have a timeout of 60mins runtime</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Improve Actions workflow #146

---

⌨️ Start Copilot coding agent tasks without leaving your editor — available in VS Code, Visual Studio, JetBrains IDEs and Eclipse.