From 69ba220ef26b00533a8685e711e717bb98c24eaa Mon Sep 17 00:00:00 2001
From: SID <nandasiddhardha@gmail.com>
Date: Fri, 3 Jul 2026 02:00:35 -0400
Subject: [PATCH 1/2] Gate CI test jobs using changed-file analysis instead of
 paths-ignore

Signed-off-by: SID <nandasiddhardha@gmail.com>
---
 .github/workflows/cicd_tests.yml | 55 +++++++++++++++++++++++++++-----
 1 file changed, 47 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/cicd_tests.yml b/.github/workflows/cicd_tests.yml
index ae3694f276..a459438e52 100644
--- a/.github/workflows/cicd_tests.yml
+++ b/.github/workflows/cicd_tests.yml
@@ -7,19 +7,11 @@ on:
       - dev
       - main
       - releasing/*
-    paths-ignore:  # skip if only docs are modified
-      - '**.md'
-      - '**.rst'
-      - 'docs/**'
   pull_request:
     branches:
       - dev
       - main
       - releasing/*
-    paths-ignore:  # skip if only docs are modified
-      - '**.md'
-      - '**.rst'
-      - 'docs/**'
 
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
@@ -52,7 +44,48 @@ env:
 # When support is dropped for a version it is important to update these as appropriate.
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      run_tests: ${{ steps.diff.outputs.run_tests }}
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+    - id: diff
+      name: Determine if non-doc changes exist
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          base_ref="origin/${{ github.base_ref }}"
+          git fetch origin "${{ github.base_ref }}" --depth=1
+          changed_files=$(git diff --name-only "$base_ref"..."${{ github.sha }}")
+        else
+          before="${{ github.event.before }}"
+          if [[ -z "$before" || "$before" == "0000000000000000000000000000000000000000" ]]; then
+            echo "run_tests=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          changed_files=$(git diff --name-only "$before"..."${{ github.sha }}")
+        fi
+
+        run_tests=false
+        while IFS= read -r file; do
+          [[ -z "$file" ]] && continue
+          if [[ "$file" == docs/* || "$file" == *.md || "$file" == *.rst ]]; then
+            continue
+          fi
+          run_tests=true
+          break
+        done <<< "$changed_files"
+
+        echo "run_tests=$run_tests" >> "$GITHUB_OUTPUT"
+
   static-checks:  # Perform static type and other checks using runtests.sh
+    needs: changes
+    if: needs.changes.outputs.run_tests == 'true'
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -84,6 +117,8 @@ jobs:
         $(pwd)/runtests.sh --build --${{ matrix.opt }} -j $(nproc --all)
 
   min-dep:  # Test with minumum dependencies installed for different OS, Python, and PyTorch combinations
+    needs: changes
+    if: needs.changes.outputs.run_tests == 'true'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -167,6 +202,8 @@ jobs:
         NGC_TEAM: ${{ secrets.NGC_TEAM }}
 
   full-dep:  # Test with full dependencies installed for different OS runners
+    needs: changes
+    if: needs.changes.outputs.run_tests == 'true'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -238,6 +275,8 @@ jobs:
       shell: bash
 
   packaging:  # Test package generation
+    needs: changes
+    if: needs.changes.outputs.run_tests == 'true'
     runs-on: ubuntu-latest
     env:
       QUICKTEST: True

From e60205021628717e14d5e385f8fe079fbe59e50e Mon Sep 17 00:00:00 2001
From: SID <nandasiddhardha@gmail.com>
Date: Fri, 3 Jul 2026 16:11:53 -0400
Subject: [PATCH 2/2] Fix workflow: add permissions, disable
 persist-credentials, use env vars for template injection safety, fail-open on
 diff errors

Signed-off-by: SID <nandasiddhardha@gmail.com>
---
 .github/workflows/cicd_tests.yml | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/cicd_tests.yml b/.github/workflows/cicd_tests.yml
index a459438e52..9ed0d51758 100644
--- a/.github/workflows/cicd_tests.yml
+++ b/.github/workflows/cicd_tests.yml
@@ -46,29 +46,40 @@ env:
 jobs:
   changes:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       run_tests: ${{ steps.diff.outputs.run_tests }}
     steps:
     - uses: actions/checkout@v6
       with:
         fetch-depth: 0
+        persist-credentials: false
     - id: diff
       name: Determine if non-doc changes exist
+      env:
+        BASE_REF: ${{ github.base_ref }}
+        EVENT_NAME: ${{ github.event_name }}
+        EVENT_BEFORE: ${{ github.event.before }}
+        EVENT_SHA: ${{ github.sha }}
       shell: bash
       run: |
         set -euo pipefail
 
-        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-          base_ref="origin/${{ github.base_ref }}"
-          git fetch origin "${{ github.base_ref }}" --depth=1
-          changed_files=$(git diff --name-only "$base_ref"..."${{ github.sha }}")
+        # Default to running tests on any failure (fail-open for safety)
+        trap 'echo "run_tests=true" >> "$GITHUB_OUTPUT"' ERR
+
+        if [[ "$EVENT_NAME" == "pull_request" ]]; then
+          base_ref="origin/$BASE_REF"
+          git fetch origin "$BASE_REF" --depth=1
+          changed_files=$(git diff --name-only "$base_ref"..."$EVENT_SHA")
         else
-          before="${{ github.event.before }}"
+          before="$EVENT_BEFORE"
           if [[ -z "$before" || "$before" == "0000000000000000000000000000000000000000" ]]; then
             echo "run_tests=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          changed_files=$(git diff --name-only "$before"..."${{ github.sha }}")
+          changed_files=$(git diff --name-only "$before"..."$EVENT_SHA")
         fi
 
         run_tests=false