build(ci): decide "does this need a build" in one reusable workflow

[lukaszlenart]

Summary

CLAUDE.md, AGENTS.md, SECURITY.md and THREAT_MODEL.md feed nothing in the build, packaging or runtime, yet every edit to them ran the full JDK matrix plus Sonar, CodeQL, OWASP and the ASF Jenkins build.

The first cut added them beside .claude/** in every paths-ignore — five copies of a list that must stay identical, plus a sixth in the maven.yml changes job. Path filters under on: can't be shared (no anchors, no variables), so the decision moves out of the triggers into one reusable workflow.

Changes

• New changes.yml (workflow_call) — owns the skip list and outputs code. Lists changed files from the pull-request files API on pull_request, from the compare API on push, and builds for any other event (workflow_dispatch, workflow_call, a new branch) or whenever the list cannot be fetched. Patterns are anchored to the repository root: core/SECURITY.md or SECURITY.md.bak still build.
• maven.yml — the inline changes job replaced by uses: ./.github/workflows/changes.yml; step-level gating on the build matrix unchanged, so Build and Test (JDK 17) keeps reporting and the PR stays mergeable.
• sonar.yml, codeql.yml, owasp.yml — every paths-ignore removed; each gets a changes job and gates its real job with needs/if.
• codeql.yml permissions — Sonar S8233 flagged the workflow-level security-events: write / id-token: write. The analyze job has always had its own block (which replaces the workflow-level one), so those grants never reached it; the workflow level is now contents: read and security-events: write stays on the job that uploads. Effective permissions unchanged.
• Jenkinsfile — Jenkins can't call a GitHub reusable workflow, so its own copy of the filter is extended to the same anchored pattern; the two copies cross-reference each other.

Cost: each GitHub workflow now starts one short runner per event to evaluate the filter instead of not triggering at all.

Verification

• Script exercised locally against the live API: PR docs: state the control test that separates hardening from a vulnerability #1964 (docs-only) → false, PR build(ci): decide "does this need a build" in one reusable workflow #1965 → true; push compare of a docs-only commit → false, of a code commit → true; new-branch before, a bad before (compare fails) and workflow_dispatch → true.
• This PR's own runs: all four changes jobs, the full Build and Test matrix, Scan, Analyze and OWASP green on the reusable-workflow layout.
• Security review of the diff: no findings (all interpolated values are GitHub-fixed-format; filenames are grep data only; no checkout in the reusable job; fail-open builds).

CI change, no ticket.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud