CI: stop charging documentation changes for a .NET restore

[erikdarlingdata]

Makes non-executable changes stop paying for a .NET restore in the required build job, while keeping the check reporting so it can never go missing and block a merge.

First, a correction to the brief's premise

The brief said the root catch-all drags CHANGELOG.md into full builds. It does not — root is four specific files (PerformanceMonitor.sln, global.json, nuget.config, .github/workflows/build.yml) and no glob there matches a .md file. I checked before changing it, so root is untouched.

I also checked the claim empirically rather than by reading, and markdown-only changes were already fast-pathing correctly:

PR	Files	build
#1707	CHANGELOG.md, tools/ag-fixture/VALIDATION.md — pure .md	1m43s
#1708	CHANGELOG.md + DarlingSelfAlertEvaluator.cs	6m58s

#1708 looked like a docs PR and is what makes the problem seem worse than it is — it contains a .cs file, so its 6m58s was a legitimate build. #1707 is the true control: 1m43s, which is actions/checkout plus the paths filter and nothing after it. The existing code: ['**', '!**/*.md'] filter was already doing its job.

The real gap is non-markdown documentation. LICENSE, CITATION.cff, .gitignore, .gitattributes, docs/signpath_logo.svg, and everything under Screenshots/ are not .md, so they matched the ** catch-all, set code=true, and paid a six-project --locked-mode restore to compile nothing. That is what this PR fixes.

The gate

An explicit allowlist of non-executable content, not a subtraction of known-code paths:

**/*.md   LICENSE   CITATION.cff   .gitignore   .gitattributes   docs/**   Screenshots/**

Allowlist direction matters: an unfamiliar new file type defaults to being treated as code, which is the safe way to be wrong. A subtraction would default new file types to "documentation" and silently stop building them.

Deliberately not in the allowlist, per the brief and verified against what each job consumes: *.sql (the installer and sql-validation.yml compile it), *.yml (workflows), *.csproj / *.props / packages.lock.json (build inputs), and *.cs however comment-only a change looks — an XML doc comment still recompiles, and the compiler is what proves it still builds.

Screenshots/** and CITATION.cff are additions beyond the brief's list. Both are unambiguously non-executable and both are real categories in this repo (Screenshots/ is PNGs; CITATION.cff is citation metadata). Flagging them explicitly since they were my call, and either is a one-line removal.

Two guards against silently under-building

Never on release, never on a push to dev/main. Those restore unconditionally. Worth being precise about the scope: this only forces the restore back on — the per-product build/test/publish steps stay path-gated exactly as they were, so push times for code commits are unchanged. I did not make dev pushes rebuild everything; that would have been a much larger behavioural change than this job asked for, and it would slow every push.

Both jobs now say what they did and why. The build job emits a ::notice:: naming the reason (release / branch push / docs-only / code changed) and, on the fast path, lists every file it classified as documentation via list-files: shell. The Darling PostgreSQL tests job gets the same treatment — its gate was already correct for documentation, but a job reporting success having quietly run nothing is indistinguishable from one that tested everything, and now it isn't.

Scope notes

• darling-pg's gate is unchanged — it was already correct (Darling/** minus Darling/**/*.md), so a docs-only change already no-ops every step. It gained only the reporting step. Note its filter deliberately includes .github/workflows/build.yml, which is why this PR runs the full TimescaleDB suite against itself rather than skipping.
• sql-validation.yml untouched — not a required check and already paths-scoped, as specified.
• The docs allowlist and the code filter's exclusions are the same list stated twice, because paths-filter has no "not in that other filter" operator. They carry a comment to keep them in step, and I added a check that they mirror exactly.

Validation

YAML parses (yaml.safe_load)                      OK
docs allowlist vs code exclusions                 IN SYNC (7/7, verified programmatically)
docs allowlist contains no build input            clean (no .sql/.yml/.csproj/.props/.cs/.json)
both new bash blocks                              bash -n syntax OK
steps moved onto the new gate                     3 (Setup .NET, Restore, Get version)
steps left on the old `code != 'false'` gate      0

Per step 4 of the brief, this PR is itself code (.yml), so it correctly takes the full path — including the Darling PG suite, since build.yml is in that job's filter. After it merges I'll open a throwaway docs-only PR (a one-sentence README edit), confirm the build check completes fast and green with the fast-path notice visible in its log, post the timing as a comment here, and close the throwaway.

🤖 Generated with Claude Code