ci: run code scan only when dependency files change

[yaroslavmokflmg]

The trivy action now checks (dorny/paths-filter) whether the PR touched anything under the scan path, minus skip-dirs, or the root pom.xml, .trivyignore or the action itself; otherwise the scan is skipped. Same action in every repo, workflows only grant pull-requests: read.

Change-Set: hotfix-conditional-code-scan

Change set flamingo-stack/fleetmdm#219: these pull requests are one change, reviewed together.

• flamingo-stack/fleetmdm#219: ci: run code scan only when dependency files change · open
• flamingo-stack/meshcentral#213: ci: run code scan only when dependency files change · open
• flamingo-stack/openframe-oss-frontend#498: ci: run code scan only when dependency files change · open
• flamingo-stack/openframe-oss-lib#2408 (this pull request): ci: run code scan only when dependency files change · landed
• flamingo-stack/openframe-oss-tenant#2379: ci: run code scan only when dependency files change · open
• …and 3 pull requests not visible

Merge order: flamingo-stack/fleetmdm#219 → flamingo-stack/meshcentral#213 → flamingo-stack/openframe-oss-frontend#498 → flamingo-stack/openframe-oss-tenant#2379

Linked by the Depends-On / Change-Set lines in these descriptions; this block is maintained by the hub.

[github-actions]

🦩 Flamingo Code Review

No findings on the current head.

Mode: advisory

---

Need another pass? Commits pushed after this review are not reviewed automatically.

• Review the new commits — the commits added since this review
• Review the whole diff again — ignoring what was already reviewed

Prefer typing? Comment @flamingo-review, or @flamingo-review full. To review every push on this pull request, add the flamingo-review-always label.

React 👍/👎 on inline comments to teach the reviewer.

Started 2026-09-28 07:55 UTC · updated 2026-09-28 07:56 UTC · workflow run