Ci/cut duplicate gha runs

.github/workflows/build.yml

@@ -6,7 +6,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.21"
+  UV_VERSION: "0.12.7"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/codecov.yml

@@ -0,0 +1,121 @@
+name: codecov.yml
+
+permissions:
+  contents: read
+  actions: read  # Required for setup-python and other actions to read action metadata
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  UV_VERSION: "0.12.7"
+  UV_PROJECT_ENVIRONMENT: venv
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'openseries/**'
+      - 'tests/**'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.python-version'
+      - '.github/workflows/codecov.yml'
+      - 'Makefile'
+      - 'make.ps1'
+      - '.pre-commit-config.yaml'
+      - 'scripts/ci-pr-paths.sh'
+  workflow_dispatch: {}
+
+jobs:
+  upload_coverage:
+    name: Upload coverage
+    runs-on: ubuntu-latest
+    environment: codecov
+    defaults:
+      run:
+        shell: bash
+    permissions:
+      contents: read
+      actions: read  # Required for setup-python and other actions to read action metadata
+      issues: write  # Required for actions/github-script to create issues on test failure
+
+    steps:
+      - name: Require master branch
+        env:
+          REF: ${{ github.ref }}
+        run: |
+          if [ "$REF" != "refs/heads/master" ]; then
+            echo "::error::Codecov reporting is limited to the master branch."
+            exit 1
+          fi
+
+      - name: Check out GitHub repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version-file: '.python-version'
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: ${{ env.UV_VERSION }}
+
+      - name: Sync dependencies (locked)
+        run: uv sync --locked --extra dev
+
+      - name: Tests with Pytest
+        id: pytest
+        continue-on-error: true
+        run: uv run pytest
+        env:
+          PYTHONPATH: ${{ github.workspace }}
+
+      - name: Create GitHub issue on failure
+        if: ${{ steps.pytest.outcome == 'failure' }}
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_OWNER: ${{ github.repository_owner }}
+          GH_REPO: ${{ github.event.repository.name }}
+          GH_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        with:
+          script: |
+            const owner = process.env.GH_OWNER;
+            const repo = process.env.GH_REPO;
+            const runUrl = process.env.GH_RUN_URL;
+
+            await github.rest.issues.create({
+              owner,
+              repo,
+              title: `Tests failed on ${new Date().toDateString()}`,
+              body: `See the full logs here: ${runUrl}`,
+            });
+
+      - name: Fail job if tests failed
+        if: ${{ steps.pytest.outcome == 'failure' }}
+        run: exit 1
+
+      - name: Upload test results to Codecov
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: junit.xml
+          report_type: test_results
+          verbose: true
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          slug: CaptorAB/openseries
+          files: coverage.xml
+          verbose: true

.github/workflows/codeql.yml

@@ -3,20 +3,19 @@ name: codeql.yml
 permissions:
   contents: read
   actions: read  # Required for setup-python and other actions to read action metadata
+  pull-requests: read  # Required to list PR files for path filtering
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.21"
+  UV_VERSION: "0.12.7"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:
-  group: codeql-${{ github.ref }}
+  group: codeql-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}
   cancel-in-progress: true
 
 on:
   workflow_dispatch: {}
-  push:
-    branches: [master]
   pull_request:
     branches: [master]
   schedule:
@@ -28,32 +27,54 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: read  # Required for setup-python and other actions to read action metadata
+      pull-requests: read  # Required to list PR files for path filtering
       security-events: write  # Required for github/codeql-action/analyze to upload results
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
+      - name: Filter paths
+        id: paths
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: bash scripts/ci-pr-paths.sh
+          'openseries/*'
+          'tests/*'
+          'pyproject.toml'
+          'uv.lock'
+          '.github/workflows/codeql.yml'
+          'scripts/ci-pr-paths.sh'
+
       - name: Initialize CodeQL
+        if: ${{ steps.paths.outputs.run == 'true' }}
         uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: python
 
       - name: Set up Python
+        if: ${{ steps.paths.outputs.run == 'true' }}
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version-file: .python-version
 
       - name: Set up uv
+        if: ${{ steps.paths.outputs.run == 'true' }}
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: ${{ env.UV_VERSION }}
 
       - name: Sync dependencies (locked)
+        if: ${{ steps.paths.outputs.run == 'true' }}
         run: uv sync --locked --extra dev
 
       - name: Perform CodeQL analysis
+        if: ${{ steps.paths.outputs.run == 'true' }}
         uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           category: /language:python

.github/workflows/deploy.yml

@@ -5,7 +5,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.21"
+  UV_VERSION: "0.12.7"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:
@@ -33,7 +33,6 @@ jobs:
     name: Build and test
     needs: gate
     runs-on: ubuntu-latest
-    environment: codecov
     permissions:
       contents: read
       issues: write  # Required for actions/github-script to create issues on test failure
@@ -93,24 +92,6 @@ jobs:
               body: `See the full logs here: ${GH_RUN_URL}`,
             });
 
-      - name: Upload test results to Codecov
-        if: ${{ github.ref_name == 'master' && success() }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          report_type: test_results
-          files: junit.xml
-          verbose: true
-
-      - name: Upload coverage to Codecov
-        if: ${{ github.ref_name == 'master' && success() }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          slug: CaptorAB/openseries
-          files: coverage.xml
-          verbose: true
-
   tag_and_release:
     name: Tag and create release
     needs: build_test

.github/workflows/docs.yml

@@ -5,40 +5,47 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.21"
+  UV_VERSION: "0.12.7"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}
   cancel-in-progress: true
 
 on:
-  # Only run on pushes to master for documentation-related changes
-  # This prevents running on every commit, only when docs actually change
   push:
     branches:
       - master
     paths:
       - 'docs/**'
+      - 'openseries/**'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.python-version'
       - '.readthedocs.yaml'
-  # Manual trigger for immediate updates (e.g., after releases)
+      - '.github/workflows/docs.yml'
+  pull_request:
+    branches:
+      - master
+    paths:
+      - 'docs/**'
+      - 'openseries/**'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.python-version'
+      - '.readthedocs.yaml'
+      - '.github/workflows/docs.yml'
   workflow_dispatch: {}
 
 jobs:
-  build-and-deploy:
-    name: Build and deploy documentation
+  build:
+    name: Build documentation
     defaults:
       run:
         shell: bash
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/master'
     permissions:
       contents: read
-      pages: write  # Required for actions/deploy-pages to deploy to GitHub Pages
-      id-token: write  # Required for OIDC token for GitHub Pages deployment
-    environment:
-      name: github-pages
-
     steps:
       - name: Check out GitHub repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -65,12 +72,36 @@ jobs:
         run: uv run --directory docs make builddocs
 
       - name: Check for documentation warnings
-        run: |
-          uv run --directory docs make strict || {
-            echo "Documentation build failed with warnings/errors:"
-            echo "This indicates potential issues that should be fixed."
-            exit 1
-          }
+        run: uv run --directory docs make strict
+
+      - name: Upload HTML artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: docs-html
+          path: docs/build/html
+          if-no-files-found: error
+          retention-days: 1
+
+  deploy:
+    name: Deploy documentation
+    needs: build
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' }}
+    defaults:
+      run:
+        shell: bash
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write  # Required for actions/deploy-pages to deploy to GitHub Pages
+      id-token: write  # Required for OIDC token for GitHub Pages deployment
+    environment:
+      name: github-pages
+    steps:
+      - name: Download HTML artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: docs-html
+          path: docs/build/html
 
       - name: Setup Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0