ci: skip platform builds and CI setup for quest and docs-only diffs

.github/workflows/android.yml

@@ -74,8 +74,15 @@ jobs:
 
       # No Rust cache: this workflow only runs on pull requests, which may not
       # save one, so it would have nothing to restore.
-      - name: Install just and cargo-ndk
-        run: cargo install --locked "just@$JUST_VERSION" "cargo-ndk@$CARGO_NDK_VERSION"
+      - name: Install cargo-ndk
+        run: cargo install --locked "cargo-ndk@$CARGO_NDK_VERSION"
+
+      # A checksummed release binary, where `cargo install` would spend ~2 minutes
+      # building just from source.
+      - name: Install just
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
+        with:
+          tool: just@${{ env.JUST_VERSION }}
 
       - name: Check
         run: just rs android

.github/workflows/check.yml

@@ -32,18 +32,30 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - name: Free disk space
-        uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
-        with:
-          tool-cache: false
-
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           # Full history so `just ci check` can diff against origin/$GITHUB_BASE_REF.
           fetch-depth: 0
 
+      # Quests, agent config, and root Markdown compile nothing, so a diff of only
+      # those skips the disk cleanup and Rust cache that exist for the build.
+      - name: Scope
+        id: scope
+        run: |
+          base=$(git merge-base "origin/$GITHUB_BASE_REF" HEAD)
+          files=$(git diff --name-only "$base")
+          if grep -qvE '^(quest/|\.claude/|[^/]+\.md$)' <<< "$files"; then
+            echo build=true >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Free disk space
+        if: steps.scope.outputs.build
+        uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
+        with:
+          tool-cache: false
+
       - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
           determinate: false
@@ -63,6 +75,7 @@ jobs:
       # scope such an entry to the PR's own branch anyway, where no later PR
       # could read it while it ate the repository's 10 GB budget.
       - name: Rust cache
+        if: steps.scope.outputs.build
         uses: ./.github/actions/rust-cache
 
       # The same recipe a developer runs locally. It diffs against
@@ -88,19 +101,33 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - name: Free disk space
-        uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
-        with:
-          tool-cache: false
-
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           # Full history so `just ci test` can diff against origin/$GITHUB_BASE_REF.
           fetch-depth: 0
 
-      - uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
+      # Same scope as the `check` job. No test covers those files either, so the
+      # job skips everything and reports green instead of spending a minute of
+      # setup to run nothing.
+      - name: Scope
+        id: scope
+        run: |
+          base=$(git merge-base "origin/$GITHUB_BASE_REF" HEAD)
+          files=$(git diff --name-only "$base")
+          if grep -qvE '^(quest/|\.claude/|[^/]+\.md$)' <<< "$files"; then
+            echo build=true >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Free disk space
+        if: steps.scope.outputs.build
+        uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
+        with:
+          tool-cache: false
+
+      - if: steps.scope.outputs.build
+        uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # main
         with:
           determinate: false
           # Trust the flake's cachix substituter. `nixConfig` in flake.nix is
@@ -115,11 +142,13 @@ jobs:
 
       # Restore only, same as the `check` job above.
       - name: Rust cache
+        if: steps.scope.outputs.build
         uses: ./.github/actions/rust-cache
 
       # NEXTEST_PROFILE picks up the longer hang timeout in .config/nextest.toml;
       # without it a runner under load could trip the local one.
       - name: Test
+        if: steps.scope.outputs.build
         run: nix develop --command just ci test
         env:
           MOQ_STRICT: 1

.github/workflows/platform.yml

@@ -8,8 +8,9 @@ name: Platform
 # breaks any of them (a moq-net type they consume, say) merges green and
 # compiles for the first time in a tag-triggered release build.
 #
-# Unfiltered, unlike android.yml: every job still finishes before check.yml, so
-# a path list tracking the dependency graphs of all that code isn't worth it.
+# Filtered to the Rust workspace and the OBS plugin, rather than to each job's
+# exact dependency graph like android.yml: these are the slowest and most
+# expensive runners in CI, and a quest or docs PR has nothing for them to build.
 #
 # Pushes to `main` and `dev` catch the break two individually green PRs make
 # once both land, which is what the nightly run of these jobs used to cover.
@@ -29,10 +30,28 @@ permissions:
 on:
   push:
     branches: [main, dev]
+    paths:
+      - "rs/**"
+      - "cpp/**"
+      - ".cargo/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - "justfile"
+      - ".github/workflows/platform.yml"
   pull_request:
     # `closed` is here only so merging/closing a PR cancels its in-flight run
     # via the concurrency group below; the jobs themselves are skipped on close.
     types: [opened, synchronize, reopened, closed]
+    paths:
+      - "rs/**"
+      - "cpp/**"
+      - ".cargo/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - "justfile"
+      - ".github/workflows/platform.yml"
 
 concurrency:
   # Keyed by event, so a merged pull request's `closed` run can't cancel the push
@@ -68,11 +87,12 @@ jobs:
           choco install nasm -y --no-progress
           "C:\Program Files\NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
 
-      # Pinned: `--locked` fixes just's own dependencies, not which version of
-      # just cargo selects.
+      # A checksummed release binary, where `cargo install` would spend ~2 minutes
+      # building just from source.
       - name: Install just
-        shell: bash
-        run: cargo install --locked "just@$JUST_VERSION"
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
+        with:
+          tool: just@${{ env.JUST_VERSION }}
 
       - name: Check
         shell: bash
@@ -94,7 +114,9 @@ jobs:
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
       - name: Install just
-        run: cargo install --locked "just@$JUST_VERSION"
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
+        with:
+          tool: just@${{ env.JUST_VERSION }}
 
       - name: Check
         run: just rs macos