Summary

Fix the check-paths job in merge-gate.yaml so docs-only PRs actually skip Go qualification. The docs-only filter was permanently false, so every PR (including pure-docs ones like #1379) ran the full gate.

Motivation / Context

check-paths used dorny/paths-filter with predicate-quantifier: 'every' over [**.md, docs/**, LICENSE], intending "every changed file is docs". But every means a single file must match every pattern in the filter — no path can match **.md AND docs/** AND LICENSE simultaneously, so the only output was always false, the compute step always set code=true, and tests / analyze / malware-scan ran on every PR.

This has been latent since the merge gate was introduced (#651); docs-only skipping never worked. Observed on #1379 (single docs/contributor/component.md edit) which ran Test, Lint, CLI E2E, E2E, Security Scan, CodeQL, and ClamAV.

Fixes: N/A
Related: #1379

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• Build/CI/tooling

Component(s) Affected

• Other: CI (.github/workflows/merge-gate.yaml)

Implementation Notes

Switched to the documented exclusion idiom: code=true iff at least one changed file is not docs/markdown/LICENSE.

code:
  - '**'
  - '\!**.md'
  - '\!docs/**'
  - '\!LICENSE'

With predicate-quantifier: 'every', a file matches code only when it matches ** AND none of the docs patterns; the filter is true if any changed file is code. Dorny sets picomatch dot: true (verified at the pinned SHA), so ** still matches dotfile code like .golangci.yaml / .settings.yaml — no fail-open on hidden config. The manual inversion step is removed; outputs.code already maps to steps.code.outputs.code.

Testing

actionlint .github/workflows/merge-gate.yaml   # clean

Behavior validated by reasoning against dorny semantics (README + picomatch dot:true at the pinned commit). The fix is exercised end-to-end by this PR itself: as a non-docs change it should set code=true and run the full gate; a follow-up docs-only PR should now show tests-skip / analyze-skip / malware-scan-skip.

Risk Assessment

• Low — Isolated CI logic change, easy to revert. Worst case mirrors today's behavior (over-running checks); the dotfile check guards the only fail-open direction.

Rollout notes: N/A

Checklist

• Linter passes (actionlint clean)
• I did not skip/disable tests to make CI green
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)