ci: run code scan only when dependency files change

[yaroslavmokflmg]

The trivy action now checks (dorny/paths-filter) whether the PR touched anything under the scan path, minus skip-dirs, or the root pom.xml, .trivyignore or the action itself; otherwise the scan is skipped. Same action in every repo, workflows only grant pull-requests: read.

Change-Set: hotfix-conditional-code-scan

Change set flamingo-stack/fleetmdm#219: these pull requests are one change, reviewed together.

• flamingo-stack/fleetmdm#219: ci: run code scan only when dependency files change · open
• flamingo-stack/meshcentral#213 (this pull request): ci: run code scan only when dependency files change · open
• flamingo-stack/openframe-oss-frontend#498: ci: run code scan only when dependency files change · open
• flamingo-stack/openframe-oss-lib#2408: ci: run code scan only when dependency files change · landed
• flamingo-stack/openframe-oss-tenant#2379: ci: run code scan only when dependency files change · open
• …and 3 pull requests not visible

Merge order: flamingo-stack/fleetmdm#219 → #213 → flamingo-stack/openframe-oss-frontend#498 → flamingo-stack/openframe-oss-tenant#2379

Linked by the Depends-On / Change-Set lines in these descriptions; this block is maintained by the hub.

[github-actions]

🦩 Flamingo Code Review

No findings on the current head.

Mode: advisory

Change set

• Not linked to flamingo-stack/openframe-oss-tenant#2379, flamingo-stack/fleetmdm#219, flamingo-stack/openframe-oss-lib#2408, flamingo-stack/openframe-oss-frontend#498 (open, same branch name). If this pull request needs one of them merged first, add a line to this pull request's description:
• Depends-On: https://github.com/flamingo-stack/openframe-oss-tenant/pull/2379
• Depends-On: https://github.com/flamingo-stack/fleetmdm/pull/219
• Depends-On: https://github.com/flamingo-stack/openframe-oss-lib/pull/2408
• Depends-On: https://github.com/flamingo-stack/openframe-oss-frontend/pull/498
• The Flamingo reviewer then checks imports and consumers against that pull request’s branch and states the merge order.

---

Need another pass? Commits pushed after this review are not reviewed automatically.

• Review the new commits — the commits added since this review
• Review the whole diff again — ignoring what was already reviewed

Prefer typing? Comment @flamingo-review, or @flamingo-review full. To review every push on this pull request, add the flamingo-review-always label.

React 👍/👎 on inline comments to teach the reviewer.

Started 2026-09-28 08:26 UTC · updated 2026-09-28 08:27 UTC · workflow run