check_modified_files.yml

name: Check for Modified Source Files

on: 
    workflow_call:
        outputs:
            non-workflow-files-changed:
                value: ${{ jobs.check-modified-files.outputs.non-workflow-files-changed }}
  
permissions:
    contents: read

jobs: 
    check-modified-files:
        name: Check if source files were modified, skip remaining jobs if not
        runs-on: ubuntu-latest
        permissions:
          pull-requests: read
        # don't run this job if triggered by Dependabot, will cause all other jobs to be skipped as well
        # don't run if triggered by a release or manual execution, as we're going to do the full build in those cases anyway
        if: github.actor != 'dependabot[bot]' || !(github.event.release || github.event_name == 'workflow_dispatch')
        outputs:
          non-workflow-files-changed: ${{ steps.filter.outputs.non-workflow-files-changed }}
        steps:
          - name: Harden Runner
            uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
            with:
              disable-sudo: true
              egress-policy: audit
          - name: Checkout
            uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
            with:
              fetch-depth: 0
          - name: Verify which files were modified
            uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
            id: filter
            with:
              base: ${{ github.ref }}
              filters: |
                non-workflow-files-changed:
                  - '!.github/**'
              list-files: 'csv'