chore(workflows): paths target on push

.github/workflows/test.yml

@@ -30,14 +30,15 @@ permissions:
 # Automatic Analysis must stay disabled on sonarcloud.io — it is mutually
 # exclusive with CI-based analysis, and it cannot import the lcov coverage
 # this workflow produces.
+# A push or PR that touches none of these paths can't change the tests or the
+# analysis, so don't spend the coverage fan-out on it. For a docs-only push
+# that means no run and no fresh branch analysis — harmless, since the last
+# analysis is still accurate for unchanged code. GitHub Actions doesn't
+# support YAML anchors, so the two lists are literal copies: keep them
+# identical when editing either one.
 on:
   push:
     branches: [main, dev]
-  pull_request:
-    branches: [main, dev]
-    # A PR that touches none of these can't change the tests or the analysis,
-    # so don't spend the coverage fan-out on it. Pushes stay unfiltered so the
-    # branch view is always refreshed from the merge result.
     paths:
       - 'server/**'
       - 'client/**'
@@ -48,10 +49,30 @@ on:
       # a native binding like better-sqlite3 is exactly what needs the suite.
       - 'package.json'
       - 'package-lock.json'
-      - 'Dockerfile'
-      - 'docker-compose.yml'
       - 'sonar-project.properties'
-      - '.github/workflows/sonarqube.yml'
+      - '.github/workflows/test.yml'
+      # Docs inside the workspaces (CLAUDE.md, READMEs, PATTERN.md) affect
+      # neither the tests nor the scan — no test reads checked-in markdown
+      # and SonarCloud has no markdown analyzer. Negations must stay last.
+      - '!**/*.md'
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - 'server/**'
+      - 'client/**'
+      - 'shared/**'
+      - 'plugin-sdk/**'
+      # npm workspaces hoist every dependency into the single root lockfile,
+      # so a dependency bump touches none of the four directories above — and
+      # a native binding like better-sqlite3 is exactly what needs the suite.
+      - 'package.json'
+      - 'package-lock.json'
+      - 'sonar-project.properties'
+      - '.github/workflows/test.yml'
+      # Docs inside the workspaces (CLAUDE.md, READMEs, PATTERN.md) affect
+      # neither the tests nor the scan — no test reads checked-in markdown
+      # and SonarCloud has no markdown analyzer. Negations must stay last.
+      - '!**/*.md'
   workflow_dispatch:
 
 # A newer push to the same branch/PR supersedes the running one — cancel it