chore(ci): gate Snyk on dependency changes (AB-008 phase 2)

[adamatdevops]

Summary

• Adds dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d (v4.0.1) step to the security job
• Gates both snyk/actions/{python,maven} invocations with if: steps.deps.outputs.{python,maven} == 'true'
• Effect: Snyk only runs when relevant manifests (pom.xml, pyproject.toml, requirements*.txt, setup.{cfg,py}) actually change in the PR/push

Motivation

Free-tier Snyk allows ~200 OSS tests/month. Current per-PR every-push scan cadence was burning 600+/month, exhausting quota mid-cycle and forcing the Snyk Marketplace App into ERROR state (see PR #12 parity test which surfaced the issue). Projected post-change usage: ~10-30 tests/month, leaving headroom.

Verification (this PR)

This PR itself touches only ci.yml — no manifest changes. Expected behavior:

• `Detect dependency manifest changes` step runs, both outputs false
• Snyk Python step skipped (visible as `skipped` in Actions tab)
• Snyk Maven step skipped
• Other CI checks (Lint, Test Backend/Frontend, Java Build, Checkov, etc.) still green
• `CI Success` aggregator still green

Part of AB-008 phase plan

• Phase 1 (done): Snyk dashboard hygiene — Container + IaC auto-import disabled
• Phase 2 (this PR): ci.yml paths filter
• Phase 3 (deferred): resume original AB-008 cutover (branch protection, in-CI security removal, token rotation) — only after ~30 days of stable Free-tier quota

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• .github/workflows/ci.yml is excluded by none and included by none
• .secrets.baseline is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ea3f6b3f-a30d-4391-b819-8108f2981878

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/AB-008-phase-2-snyk-paths-filter

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sentry]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

@@            Coverage Diff             @@
##             main      #13      +/-   ##
==========================================
- Coverage   53.02%   52.83%   -0.19%     
==========================================
  Files         110      110              
  Lines        6337     6337              
  Branches     1058     1058              
==========================================
- Hits         3360     3348      -12     
- Misses       2872     2879       +7     
- Partials      105      110       +5     

Flag	Coverage Δ
backend	63.58% <ø> (-0.28%)	⬇️
frontend	28.25% <ø> (ø)
see 4 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c8b086e...bc30a5f. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.