• Remove conditional skip of detect-changes job on pull requests
• Allow detect-changes to run for all pull request events
• Simplify workflow condition logic by removing fork check

Remove pull request skip condition from detect-changes

• Removed conditional if statement that skipped detect-changes job on pull requests
• Job now runs for all pull request events without fork repository check
• Simplifies workflow logic by removing the fork condition filter

.github/workflows/tests.yml

Description

If detect-changes fails, all jobs that needs: detect-changes will be skipped, but the final
all-passed job can still exit 0 because it does not include detect-changes in its needs list.
Now that detect-changes runs on same-repo PRs too, this can produce false-green PR checks even
when change detection is broken.

Code

.github/workflows/tests.yml[R13-16]

  detect-changes:
    runs-on: ubuntu-latest
-    if: ${{ (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.fork) }}
    outputs:
      changes: ${{ steps.detect-changes.outputs.changes }}

Evidence

all-passed aggregates only the results of jobs in its needs: array; detect-changes is not
included. Meanwhile, essentially all meaningful jobs depend on detect-changes, so a failure there
prevents the rest of the workflow from running and can be silently treated as success by
all-passed.

.github/workflows/tests.yml[13-17]
.github/workflows/tests.yml[56-59]
.github/workflows/tests.yml[152-164]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`all-passed` can report success even if `detect-changes` fails, because `detect-changes` is not part of `all-passed.needs`.

### Issue Context
Most jobs depend on `detect-changes`; when it fails, they will skip. `all-passed` only checks failures among its `needs` jobs, so it may not detect the root failure.

### Fix Focus Areas
- .github/workflows/tests.yml[152-164]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

With detect-changes no longer skipped on same-repo PRs, this workflow will now run for internal
pull requests too, but it does not set any explicit permissions:. That makes the workflow’s token
capabilities depend on repo/org defaults and increases the blast radius if defaults are broader than
needed.

Code

.github/workflows/tests.yml[R13-16]

  detect-changes:
    runs-on: ubuntu-latest
-    if: ${{ (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.fork) }}
    outputs:
      changes: ${{ steps.detect-changes.outputs.changes }}

Evidence

tests.yml runs on pull_request and has no explicit permissions: block, while other workflows
in this repo do explicitly scope permissions (suggesting least-privilege is an established practice
here). As this workflow executes third-party actions and project scripts on PRs, explicitly scoping
GITHUB_TOKEN permissions reduces accidental privilege exposure and makes behavior consistent
across settings.

.github/workflows/tests.yml[1-7]
.github/workflows/tests.yml[13-22]
.github/workflows/pull-request.yml[14-20]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow runs on `pull_request` but does not explicitly scope `GITHUB_TOKEN` permissions.

### Issue Context
Other workflows in the repo explicitly set `permissions:`, indicating a least-privilege approach. With this workflow now running on same-repo PRs as well, relying on repo/org defaults is riskier and less predictable.

### Fix Focus Areas
- .github/workflows/tests.yml[1-25]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools