test: pin root-doc paths-ignore entries with a regression test

Addresses review feedback on #1791 from thymikee: the docs-only
classifier for AGENTS.md/CHANGELOG.md/CONTEXT.md/CONTRIBUTING.md/
LICENSE/SECURITY.md across ios.yml/android.yml/linux.yml/macos.yml/
ci.yml/size.yml had no regression pin. Neither check:gate-manifest
(only proves a *registered check* is reachable) nor actionlint (only
validates YAML shape) nor generic Markdown coverage would catch a
single dropped entry — e.g. LICENSE reappearing in one workflow's
paths-ignore list but not another's would silently put a full 9-15 min
device run back on prose-only PRs.

test/ci/root-docs-paths-ignore.test.ts parses the six real workflow
files and asserts, using the same matchesGlob the gate-manifest model
uses to decide lane triggering, that each of the six root docs is
ignored by each workflow's pull_request paths-ignore. Registered in
vitest.config.ts's unit-core project next to its sibling
upload-agent-device-artifacts.test.ts (parse-only, no device/subprocess
lane needed).

Verified red on main (all 36 file x doc assertions fail — confirmed via
a throwaway script reading `git show main:.github/workflows/*.yml`)
and green on this branch (6/6). Full unit-core project (873 files /
6641 tests) still passes; check:gate-manifest and
check:gate-manifest:test unchanged (48 checks / 33 lanes, 28/28).

Author: thymikee

test/ci/root-docs-paths-ignore.test.ts

@@ -0,0 +1,58 @@
+// Regression pin for #1781 A9: the six root-level docs files
+// (AGENTS.md, CHANGELOG.md, CONTEXT.md, CONTRIBUTING.md, LICENSE, SECURITY.md)
+// must stay in the `pull_request` `paths-ignore` list of every workflow that
+// also ignores `docs/**`/`website/**`/`README.md` — the four device lanes plus
+// `ci.yml` and `size.yml`. Nothing else derives this: `check:gate-manifest`
+// only asks whether a *registered check* is reachable, generic Markdown
+// coverage does not look at workflow trigger config at all, and `actionlint`
+// only validates YAML shape, not policy — so a PR that quietly drops one entry
+// (e.g. re-adds `LICENSE` to a device workflow while missing it in `size.yml`)
+// would pass every other gate and put a full 9-15 min device run back on
+// prose-only PRs. This test reads the real workflow files and asserts the
+// behavior directly, via the same glob matcher the gate-manifest model uses
+// to decide whether a lane triggers for a given path.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { expect, test } from 'vitest';
+import { parse } from 'yaml';
+import { matchesGlob } from '../../scripts/gate/workflows.ts';
+
+const repoRoot = path.resolve(import.meta.dirname, '../..');
+
+const WORKFLOWS = ['ios.yml', 'android.yml', 'linux.yml', 'macos.yml', 'ci.yml', 'size.yml'];
+
+const ROOT_DOCS = [
+  'AGENTS.md',
+  'CHANGELOG.md',
+  'CONTEXT.md',
+  'CONTRIBUTING.md',
+  'LICENSE',
+  'SECURITY.md',
+];
+
+type WorkflowDoc = {
+  // A bare `on:` key can parse as the boolean key `true` under YAML 1.1
+  // semantics; scripts/gate/workflows.ts already guards against this, so this
+  // test mirrors that fallback rather than trusting `on` alone.
+  on?: Record<string, { 'paths-ignore'?: string[] }>;
+  true?: Record<string, { 'paths-ignore'?: string[] }>;
+};
+
+function pathsIgnore(file: string): string[] {
+  const doc = parse(
+    fs.readFileSync(path.join(repoRoot, '.github/workflows', file), 'utf8'),
+  ) as WorkflowDoc;
+  const on = doc.on ?? doc.true ?? {};
+  return on.pull_request?.['paths-ignore'] ?? [];
+}
+
+test.each(WORKFLOWS)('%s skips a pull_request triggered by only a root doc', (file) => {
+  const ignored = pathsIgnore(file);
+  for (const rootDoc of ROOT_DOCS) {
+    expect(
+      ignored.some((pattern) => matchesGlob(pattern, rootDoc)),
+      `${file}'s paths-ignore must match ${rootDoc} (got ${JSON.stringify(ignored)})`,
+    ).toBe(true);
+  }
+});

vitest.config.ts

@@ -86,6 +86,9 @@ export default defineConfig({
             'scripts/__tests__/package-closure-audit.test.ts',
             // Parses CI configuration only, so this action guard needs no device or subprocess lane.
             'test/ci/upload-agent-device-artifacts.test.ts',
+            // #1781 A9: pins the root-doc paths-ignore entries directly against the
+            // real workflow YAML, parse-only like its sibling above.
+            'test/ci/root-docs-paths-ignore.test.ts',
             // The frozen replay-compat corpus (#1417): parse-only, no device or
             // subprocess work, so it belongs in the fast lane next to the
             // grammar it guards.