Replace fkirc/skip-duplicate-actions across the org

[rtibbles]

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Overview

fkirc/skip-duplicate-actions is unmaintained, pinned to @master, and runs on Node 20, which GitHub removed from runners on 2026-09-16. Nine org repos use it to skip CI jobs when a PR's changed files don't touch what the job tests, while keeping required status checks green. This issue replaces it everywhere and settles on one gating pattern per case, so skipped required checks never hang as "Expected" and CI doesn't start runners it then skips.

Scope

• Every workflow in the 9 repos that uses fkirc/skip-duplicate-actions, one sub-issue per repo.
• Each workflow keeps its current path list; only the mechanism changes.
• Excluded: fkirc's duplicate-run skipping and run cancellation. Workflows that need cancellation already use concurrency:.

Guidance

• Detect changes with dorny/paths-filter, pinned by SHA with a version comment: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3.
• A paths_ignore list maps to predicate-quantifier: every with negated patterns.
• Native path filters: on.<event>.paths / paths-ignore.
• Why a filtered-out required check hangs: Handling skipped but required checks.
• Existing aggregator to copy: kolibri tox.yml stage2_required_checks.

Strategy

• Workflow with no required check: move its path list to native paths:/paths-ignore: on its triggers, and delete pre_job.
• Workflow with no path list: delete pre_job and the needs/if that reference it.
• Required check from a single non-matrix job: a dorny/paths-filter detect job plus a job-level if. The check name is unchanged.
• Required check from a matrix job or step-level gating: job-level if plus one aggregator job (if: always(), fails when any needed job failed or was cancelled). The aggregator becomes the required check.
• Each PR body lists the required checks to add to and remove from the ruleset. A maintainer edits the ruleset when merging.

Testing Requirements

• Each migration PR links one run where the gated jobs ran and one where they were skipped with every required check green. A run on the contributor's fork is acceptable where the PR's own diff can't produce a skip.
• actionlint passes on every changed workflow.

Acceptance Criteria

• Org-wide code search for fkirc/skip-duplicate-actions returns no results.
• Every ruleset change listed in the sub-issue PRs has been applied.

AI usage

I used Claude Code to survey every workflow using the action and each repo's required checks, and to propose options. I chose the approach, the gating rule and the per-repo split, and reviewed each section before filing.