From 7b6d10624027b8da798268080854ad14c06dae6e Mon Sep 17 00:00:00 2001
From: VinPropane <don@donmail.org>
Date: Mon, 4 May 2026 20:16:08 -0400
Subject: [PATCH 1/3] chore: run .NET workflow on all PRs to main

---
 .github/workflows/dotnet.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 5a75377..8353c5f 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -1,4 +1,6 @@
 # Build and test the C# solution (server + tests). Targets repo root NeonSprawl.sln.
+# pull_request has no paths filter so this job always runs on PRs to main — add check
+# ".NET / build" under branch protection required status checks (see PR gate workflow comment).
 name: .NET
 
 on:
@@ -10,10 +12,6 @@ on:
       - ".github/workflows/dotnet.yml"
   pull_request:
     branches: [main]
-    paths:
-      - "NeonSprawl.sln"
-      - "server/**"
-      - ".github/workflows/dotnet.yml"
 
 jobs:
   build:

From 0fd2dfe78048d681d72e6fc9d9bd010497dd85f6 Mon Sep 17 00:00:00 2001
From: VinPropane <don@donmail.org>
Date: Mon, 4 May 2026 20:21:18 -0400
Subject: [PATCH 2/3] chore: skip .NET steps on PR when server paths unchanged

---
 .github/workflows/dotnet.yml | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 8353c5f..2857912 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -1,6 +1,8 @@
 # Build and test the C# solution (server + tests). Targets repo root NeonSprawl.sln.
-# pull_request has no paths filter so this job always runs on PRs to main — add check
-# ".NET / build" under branch protection required status checks (see PR gate workflow comment).
+# PRs: workflow always runs (so ".NET / build" can be a required check). Path-sensitive
+# work uses step-level `if` — skipped steps still leave the job successful (unlike a
+# workflow skipped via `on.paths`, which leaves the required check missing/pending).
+# push: path filter on `on` avoids redundant runs on unrelated commits to main.
 name: .NET
 
 on:
@@ -34,18 +36,37 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Detect .NET-relevant changes (PR only)
+        id: paths
+        if: github.event_name == 'pull_request'
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            server:
+              - "NeonSprawl.sln"
+              - "server/**"
+              - ".github/workflows/dotnet.yml"
+
+      - name: Skip .NET build (no server-side paths in this PR)
+        if: github.event_name == 'pull_request' && steps.paths.outputs.server != 'true'
+        run: echo "Skipping .NET restore, build, and tests."
+
       - name: Setup .NET
+        if: github.event_name == 'push' || steps.paths.outputs.server == 'true'
         uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
 
       - name: Restore
+        if: github.event_name == 'push' || steps.paths.outputs.server == 'true'
         run: dotnet restore NeonSprawl.sln
 
       - name: Build
+        if: github.event_name == 'push' || steps.paths.outputs.server == 'true'
         run: dotnet build NeonSprawl.sln --no-restore --configuration Release
 
       - name: Test
+        if: github.event_name == 'push' || steps.paths.outputs.server == 'true'
         env:
           ConnectionStrings__NeonSprawl: >-
             Host=localhost;Port=5432;Database=neon_sprawl;Username=neon_sprawl;Password=neon_sprawl_dev

From 6b75fbdbd088bad2d4f43bef563ced12759d03b5 Mon Sep 17 00:00:00 2001
From: VinPropane <don@donmail.org>
Date: Mon, 4 May 2026 20:24:35 -0400
Subject: [PATCH 3/3] chore: grant pull-requests read for paths-filter API

---
 .github/workflows/dotnet.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 2857912..7334c57 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -15,6 +15,12 @@ on:
   pull_request:
     branches: [main]
 
+# dorny/paths-filter reads the PR file list from the GitHub API; the default token
+# scope is too narrow without pull-requests:read ("Resource not accessible by integration").
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   build:
     runs-on: ubuntu-latest