From a0ce9cdb82166492e5e51fd394797d11ea9786e4 Mon Sep 17 00:00:00 2001
From: Christoph Knittel <ck@cca.io>
Date: Sat, 14 Nov 2026 08:13:11 +0000
Subject: [PATCH] Build the dev container in CI only when its inputs change

The test-devcontainer job built the container from scratch on every pull
request, about 10 minutes. It now lists the pull request's files first
and builds only when the container definition, the opam or yarn
dependencies its setup installs, the Makefile or ci.yml change; pushes,
and pull requests whose files can't be listed, still build it. The job
always runs, so ci-ok still sees it succeed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kbf3gKyiYMf54wPRxFdUWe
Signed-off-by: Christoph Knittel <ck@cca.io>
---
 .github/workflows/ci.yml                  | 22 +++++++++++++++++++++-
 changes/ci-devcontainer-paths.internal.md |  1 +
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 changes/ci-devcontainer-paths.internal.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 916c515a42..9b058134a0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -663,11 +663,31 @@ jobs:
   test-devcontainer:
     runs-on: ubuntu-26.04-arm
     steps:
+      # Building the dev container takes about 10 minutes. On pull requests it
+      # runs only when the container's inputs change: its definition, the opam
+      # and yarn dependencies its setup installs, the Makefile, or this
+      # workflow. If the changed files can't be listed, it runs.
+      - name: Check whether the dev container is affected
+        id: changes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          affected=true
+          if [ "$EVENT" = pull_request ] &&
+            files=$(gh pr diff "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --name-only) &&
+            ! grep -qE '^(\.devcontainer/|Makefile$|dune-project$|[^/]*\.opam(\.template)?$|\.yarnrc\.yml$|yarn\.lock$|\.yarn/|\.github/workflows/ci\.yml$)|(^|/)package\.json$' <<< "$files"; then
+            affected=false
+          fi
+          echo "affected=$affected" | tee -a "$GITHUB_OUTPUT"
       - name: Checkout
+        if: steps.changes.outputs.affected == 'true'
         uses: actions/checkout@v7
       - name: Run make in dev container
+        if: steps.changes.outputs.affected == 'true'
         uses: devcontainers/ci@v0.3
-        with:    
+        with:
           push: never
           runCmd: make
 
diff --git a/changes/ci-devcontainer-paths.internal.md b/changes/ci-devcontainer-paths.internal.md
new file mode 100644
index 0000000000..4bb0587467
--- /dev/null
+++ b/changes/ci-devcontainer-paths.internal.md
@@ -0,0 +1 @@
+- Build the dev container in CI only for pull requests that change its inputs.