💚 Only trigger CI when relevant code changes

[Brend-Smits]

https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onpushpull_requestpaths

Auto merge is enabled - Squashing commits.

[codecov]

Codecov Report

Merging #56 (d9e7e77) into main (2c4e21f) will not change coverage.
The diff coverage is n/a.

❗ Current head d9e7e77 differs from pull request most recent head 6821bf8. Consider uploading reports for the commit 6821bf8 to get more accurate results

@@           Coverage Diff           @@
##             main      #56   +/-   ##
=======================================
  Coverage   83.33%   83.33%           
=======================================
  Files           4        4           
  Lines         210      210           
=======================================
  Hits          175      175           
  Misses         24       24           
  Partials       11       11           

Flag	Coverage Δ
unittests	83.33% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2c4e21f...6821bf8. Read the comment docs.

[JeroenKnoops]

Closes #57

[marcofranssen]

We are missing some files.

• Dockerfile
• .goreleaser.yml

Maybe more.

[JeroenKnoops]

I think we should only disable CODECOV results when no code has been changed. ( only disable

slsa-provenance-action/.github/workflows/ci.yaml

Line 58 in 6821bf8

- name: Upload Code Coverage

)

I think running the normal tests on dependabot changes is valuable.

We should also run them on releases..

[Brend-Smits]

Perhaps we can exclude files instead of include?

[marcofranssen]

I think we should only disable CODECOV results when no code has been changed. I think running the normal tests on dependabot changes is valuable.

We should also run them on releases..

Oh yes, fully agree, dependabot will now indeed not run the ci.

Should we really go into complicating the pipeline to skip codecov after all? What will we win there?

[JeroenKnoops]

In the issue #57 I propose two possible solutions.. maybe adding the CODECOV token in dependabot secret is the better solution.