Run the gating checks on every pull request

Required status checks and paths filters do not mix. A filtered workflow
creates no check context on a pull request that misses the filter, and a
required context that never reports blocks the merge indefinitely -- so
python-tests, ruff, unsupported-python-install and check_version cannot be
required while they sit behind filters. That is not a coincidence in the
current required set: package-check, the e2e jobs and dependency-review-gate
are the five that are required today, and they are exactly the ones with no
paths filter.

Drop the filters from the pull_request triggers. The push triggers keep
theirs, since branch protection does not read those. Costs about a minute of
runner time per pull request.

Author: lelia

.github/workflows/dependency-audit.yml

@@ -14,11 +14,10 @@ env:
 on:
   schedule:
     - cron: "17 6 * * *"
+  # Unfiltered on purpose: a required status check behind a paths filter never
+  # reports on a pull request that misses the filter, and an unreported
+  # required check blocks the merge forever.
   pull_request:
-    paths:
-      - "pyproject.toml"
-      - "uv.lock"
-      - ".github/workflows/dependency-audit.yml"
   push:
     branches: [main]
     paths:

.github/workflows/python-tests.yml

@@ -13,14 +13,12 @@ on:
       - "pyproject.toml"
       - "uv.lock"
       - ".github/workflows/python-tests.yml"
+  # Deliberately unfiltered, unlike the push trigger above. A required status
+  # check that sits behind a paths filter never reports on a pull request that
+  # misses the filter, and an unreported required check blocks the merge
+  # forever. These jobs finish in well under a minute, so running them on every
+  # pull request costs little and is what makes them safe to require.
   pull_request:
-    paths:
-      - "socketsecurity/**/*.py"
-      - "tests/unit/**/*.py"
-      - "tests/core/**/*.py"
-      - "pyproject.toml"
-      - "uv.lock"
-      - ".github/workflows/python-tests.yml"
   workflow_dispatch:
 
 permissions:

.github/workflows/version-check.yml

@@ -1,13 +1,10 @@
 name: Version Check
 on:
+  # Unfiltered on purpose: a required status check behind a paths filter never
+  # reports on a pull request that misses the filter, and an unreported
+  # required check blocks the merge forever.
   pull_request:
     types: [opened, synchronize, ready_for_review]
-    paths:
-      - 'socketsecurity/**'
-      - 'pyproject.toml'
-      - 'uv.lock'
-      # Included so a change to the check itself is exercised by its own PR.
-      - '.github/workflows/version-check.yml'
 
 permissions:
   contents: read

CHANGELOG.md

@@ -29,6 +29,11 @@
 - Unit Tests now reports only on the test suite. Previously an advisory
   published against an unchanged pin surfaced as "Unit Tests failed" while
   every test passed.
+- Dropped the `paths` filters from the pull request triggers on Unit Tests and
+  Version Check. A required status check behind a `paths` filter never reports
+  on a pull request that misses the filter, and an unreported required check
+  blocks the merge indefinitely, so the filters had to go before these jobs
+  could be marked required. Each finishes in well under a minute.
 
 ## 2.9.4