[PetrefiedThunder]

Cuts GitHub Actions minutes after the October overage, without reducing coverage on main.

• ci.yml, pull_request: the detect job diffs against the PR base and keeps only projects that own a changed file. Shared paths (.github/, spec/, repo-root files, anything outside a discovered project) restore the full matrix. push to main, merge_group, schedule and workflow_dispatch keep the full matrix. Python 3.11 to 3.14 and Node 22/24 are unchanged.
• CI result still runs with if: always() and now treats skipped jobs as passing; failure or cancelled still fail it.
• Postgres proofs / gateway and Postgres concurrency / gateway run on PRs only when gateway/ or a shared path changes; always on main, merge_group and dispatch.
• secrets.yml: push runs limited to main. PR, merge_group, weekly schedule and dispatch unchanged.

Job names, permissions and action SHA pins are unchanged. YAML parse and actionlint pass. Written by the Cursor CLI fleet engine.

---

Note

Medium Risk
PR coverage now depends on static dependency scanning and fallbacks; a missed edge could skip consumer tests, though shared-path changes still run the full matrix.

Overview
PR CI now limits Python/TypeScript matrices to changed projects plus anything that depends on them, instead of a large hand-maintained list of special cases (e.g. “always run gateway when SDK changes”).

A new project_dependents.py builds a repo dependency graph from manifests, Dockerfiles, imports, CI sdk/python installs, and a small fallback map, then expand_with_dependents walks reverse edges so consumers (gateway, integrations) still run when a dependency changes. limit_matrix applies this on pull_request; touches under .github/, spec/, or paths outside discovered projects still force the full matrix. The gateway output (Postgres / gateway-gated jobs) follows whether gateway is in that expanded set or was directly changed.

ci.yml wires the changes job to limit_matrix and is_shared, adds matrix ["skip"] placeholders when no Python/TypeScript projects match (avoids empty fromJSON failures), and updates CI result so skipped jobs count as green while failure / cancelled still fail the required check.

^{Reviewed by Cursor Bugbot for commit f33e773. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T04:05:54.360539Z	0097f6d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0097f6dfbf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[PetrefiedThunder]

Addressed the P1 finding: the PR matrix now adds every project that depends on a changed one, transitively (.github/scripts/project_dependents.py builds the graph from manifests, Dockerfile COPY, the gateway's editable SDK install and imports, with a commented fallback map). sdk/python now schedules the gateway and all four integrations, any integration change schedules the gateway, and the Postgres jobs follow whenever the gateway is in the set.