Stop 13 jobs firing on a README edit, and delete an SBOM check that never ran

Two GitHub-side changes, both about not wasting runs.

PATH FILTERS. tests.yml (nine jobs across three OSes and three Pythons) and
python-ci.yml (four) both triggered on every push and every pull request with
no path restriction, so editing a markdown file spent thirteen jobs. They now
trigger on the Python implementation and the files that pin its environment.
ts-parity keeps triggering on src/** as well as js/**, deliberately: Python is
the reference implementation the port is validated against, so a change there
can break parity even when no TypeScript moved.

THE SBOM STEP IS GONE. It invoked `@cyclonedx/cyclonedx-npm@latest
--package-lock-only`, which is the NPM tool and reads package-lock.json — a
file this pnpm workspace does not have and never will. It could not have
worked on any run. It then swallowed the failure with `|| echo "non-fatal"`
and uploaded with `if-no-files-found: warn`, two independent layers stopping
it from going red, and its log said "No files were found with the provided
path" every time.

Removed rather than pinned. Pinning the version of a tool that cannot read
this repository's lockfile fixes the wrong problem, and a security check that
cannot fail is the same anti-pattern as the pwsh exit-code bug fixed earlier
today — worse than absent, because it is trusted. `pnpm audit --audit-level
moderate` stays and does fail on findings. A real bill of materials wants a
pnpm-native generator, tracked in TODO.md.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

.github/workflows/python-ci.yml

@@ -3,8 +3,32 @@ name: CI
 on:
   push:
     branches: [ "**" ]
+    paths:
+      # The Python implementation and everything that pins its environment.
+      # It is the reference implementation the TypeScript port is validated
+      # against, so it still has to be tested — but a docs edit or a change
+      # under js/ has no business firing 4 jobs.
+      - "src/**"
+      - "scripts/**"
+      - "pyproject.toml"
+      - "poetry.lock"
+      - "requirements.lock"
+      - "conftest.py"
+      - ".github/workflows/python-ci.yml"
   pull_request:
     branches: [ "**" ]
+    paths:
+      # The Python implementation and everything that pins its environment.
+      # It is the reference implementation the TypeScript port is validated
+      # against, so it still has to be tested — but a docs edit or a change
+      # under js/ has no business firing 4 jobs.
+      - "src/**"
+      - "scripts/**"
+      - "pyproject.toml"
+      - "poetry.lock"
+      - "requirements.lock"
+      - "conftest.py"
+      - ".github/workflows/python-ci.yml"
   schedule:
     - cron: '0 3 * * *'
 

.github/workflows/tests.yml

@@ -3,8 +3,32 @@ name: Tests
 on:
   push:
     branches: ["**"]
+    paths:
+      # The Python implementation and everything that pins its environment.
+      # It is the reference implementation the TypeScript port is validated
+      # against, so it still has to be tested — but a docs edit or a change
+      # under js/ has no business firing 9 jobs.
+      - "src/**"
+      - "scripts/**"
+      - "pyproject.toml"
+      - "poetry.lock"
+      - "requirements.lock"
+      - "conftest.py"
+      - ".github/workflows/tests.yml"
   pull_request:
     branches: ["**"]
+    paths:
+      # The Python implementation and everything that pins its environment.
+      # It is the reference implementation the TypeScript port is validated
+      # against, so it still has to be tested — but a docs edit or a change
+      # under js/ has no business firing 9 jobs.
+      - "src/**"
+      - "scripts/**"
+      - "pyproject.toml"
+      - "poetry.lock"
+      - "requirements.lock"
+      - "conftest.py"
+      - ".github/workflows/tests.yml"
 
 jobs:
   test:

.github/workflows/ts-parity.yml

@@ -94,19 +94,19 @@ jobs:
         # The Python side has had a dependency audit for a while; the
         # JavaScript tree had none.
         run: pnpm audit --audit-level moderate
-      - name: Generate a CycloneDX SBOM
-        run: |
-          npx --yes @cyclonedx/cyclonedx-npm@latest \
-            --output-format JSON \
-            --output-file "$RUNNER_TEMP/seedpass-js-sbom.json" \
-            --package-lock-only || echo "SBOM generation failed (non-fatal)"
-      - name: Upload SBOM
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: seedpass-js-sbom
-          path: ${{ runner.temp }}/seedpass-js-sbom.json
-          if-no-files-found: warn
+      # An SBOM step used to sit here and it never worked. It invoked
+      # `@cyclonedx/cyclonedx-npm@latest --package-lock-only`, which is the
+      # NPM tool and reads package-lock.json — a file this pnpm workspace does
+      # not have and never will. It then swallowed the failure with
+      # `|| echo "non-fatal"` and uploaded with `if-no-files-found: warn`, so
+      # two separate layers stopped it from ever going red. Its logs said
+      # "No files were found with the provided path" on every run.
+      #
+      # Removed rather than pinned: pinning the version of a tool that cannot
+      # read this repository's lockfile fixes the wrong problem. Generating a
+      # real SBOM needs a pnpm-native generator, which is tracked in TODO.md.
+      # `pnpm audit` above is the supply-chain check that actually runs and
+      # actually fails.
 
   # Fixtures prove the two implementations compute the same values; this job
   # proves they can read each other's on-disk profiles and backups.