ci: run Go jobs only when code changes

.github/changed-code.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Sets code=true when a change can affect build/lint/acceptance results.
+# Fails open: anything unexpected runs the full suite.
+set -uo pipefail
+
+emit() {
+  echo "code=$1" >> "$GITHUB_OUTPUT"
+  echo "code=$1"
+  exit 0
+}
+
+# Manual runs always test.
+[ "${EVENT:-}" = "workflow_dispatch" ] && emit true
+
+# No usable base (new branch, force push, first commit) — do not guess.
+case "${BASE:-}" in
+  "" | 0000000000000000000000000000000000000000) emit true ;;
+esac
+
+changed="$(git diff --name-only "$BASE" "$HEAD" 2>/dev/null)" || emit true
+[ -z "$changed" ] && emit false
+
+echo "Changed files:"
+echo "$changed"
+
+if echo "$changed" | grep -qE '^(internal/|tools/|main\.go|go\.(mod|sum)|\.golangci\.yml|docker/test/|scripts/testacc\.sh|\.github/(workflows/|changed-code\.sh))'; then
+  emit true
+fi
+
+emit false

.github/workflows/acceptance.yml

@@ -27,8 +27,27 @@ permissions:
   contents: read
 
 jobs:
+  # Job-level gate, not a workflow `paths:` filter: a path-filtered required
+  # check never reports and blocks the PR forever, while a skipped job passes.
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - id: filter
+        env:
+          EVENT: ${{ github.event_name }}
+          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: bash .github/changed-code.sh
+
   acceptance:
     name: Acceptance Tests
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 40
 
@@ -48,8 +67,11 @@ jobs:
       # ── Optionally override the version in .env ──────────────────────────────
       - name: Override OPENMETADATA_VERSION
         if: inputs.openmetadata_version != ''
+        # Via env, not direct interpolation — the input must not reach the shell as code.
+        env:
+          OM_VERSION: ${{ inputs.openmetadata_version }}
         run: |
-          sed -i "s/^OPENMETADATA_VERSION=.*/OPENMETADATA_VERSION=${{ inputs.openmetadata_version }}/" docker/test/.env
+          sed -i "s/^OPENMETADATA_VERSION=.*/OPENMETADATA_VERSION=${OM_VERSION}/" docker/test/.env
           echo "Using OpenMetadata version: ${{ inputs.openmetadata_version }}"
 
       # ── Go toolchain ────────────────────────────────────────────────────────

.github/workflows/ci.yml

@@ -11,7 +11,27 @@ permissions:
   contents: read
 
 jobs:
+  # Decides whether the Go jobs need to run at all. Must be a job-level `if:`
+  # on the consumers, not a workflow `paths:` filter — a path-filtered required
+  # check never reports and blocks the PR forever.
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - id: filter
+        env:
+          EVENT: ${{ github.event_name }}
+          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: bash .github/changed-code.sh
+
   lint:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -24,6 +44,8 @@ jobs:
           version: v2.11.4
 
   build:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1