[tae898]

A PR runs two workflows, 24 jobs in Test Python Bindings (bandit, dependency audit, jar download, 20 platform legs, summary) and 22 in Test Python Examples, 46 in all, on the standard GitHub-hosted runners. The macOS and Windows concurrent-job caps are shared with ArcadeData/arcadedb's own CI, so a burst of 46 jobs can queue upstream. This PR removes runs that test nothing new. Every job and every matrix leg stays for a code change.

What runs now

Event	Files changed	Before	After
PR opened or updated, ready for review	any code, tests, examples, scripts, pyproject, setup.py, the workflows, README.md, tests/README.md, other files	46 jobs	46 jobs (unchanged)
PR opened or updated, ready for review	only docs/**, **/*.adoc, CLAUDE.md, examples/README.md, LICENSE*	46 jobs	0 (no run)
PR opened or updated, draft	any	46 jobs	2 jobs (bandit, dependency audit); download, matrices and summaries are skipped
PR marked ready for review	any	no run	the "ready, any" row above (46 jobs, or 0 if docs-only)
Push to a PR branch while the previous run is going	any	Bindings: the stale run finishes all 24 jobs; Examples: cancelled	both workflows cancel the stale run
Push to main	code	46 jobs	46 jobs, never cancelled, never replaced while queued
Push to main	docs-only (list above)	46 jobs	0 (no run)
Nightly schedule (03:00 Bindings, 04:00 Examples)	n/a	24 + 22 jobs	unchanged
workflow_dispatch, workflow_call (release)	n/a	unchanged	unchanged, the path filter and the draft check do not apply

Changes

1. Docs-only changes skip both workflows through paths-ignore on push and pull_request. Main is not protected (gh api repos/ArcadeData/arcadedb-python/branches/main/protection returns 404), so no required check can be left pending. Two Markdown files are kept as triggers on purpose, even though the request was **/*.md: README.md (the wheel build copies it, scripts/Dockerfile.build and pyproject.toml readme) and tests/README.md (tests/test_no_monorepo_wording.py reads both). Skipping them would mean a README edit is never checked by that test. docs/** is safe to skip because tests/conftest.py collect-ignores test_docs_examples.py while docs/index.md is absent; a comment in both workflows says to drop docs/** from the list if that Markdown site comes back.
2. test-python-bindings.yml gets the supersede rule that test-python-examples.yml already had: cancel-in-progress only for pull_request. Two small changes to the group in both files, so the rule holds for the events it must not touch: non-PR events use run_id instead of github.ref (a push and the nightly run share refs/heads/main, and a queued run in a group is replaced by a newer one even with cancel-in-progress: false), and the group names the workflow literally instead of github.workflow, which is the caller's name in a workflow_call and would put both workflows of a release in one group.
3. Draft PRs: pull_request has types: [opened, synchronize, reopened, ready_for_review], and download-jars, the platform matrix and the summary job carry github.event_name != 'pull_request' || github.event.pull_request.draft == false. The summary jobs (if: always()) get the same condition, otherwise a skipped matrix would turn them red. In Bindings, bandit and the dependency audit still run on drafts: they are single Linux jobs and give fast feedback.
4. Schedules: kept, one nightly per workflow. The jars come from arcadedata/arcadedb:latest (ARCADEDB_IMAGE_TAG defaults to latest), a tag upstream re-pushes on every deploy (last push seen on Docker Hub: 2026-10-23 16:54 UTC). A night with no commit here still tests a different engine, so a skip-if-main-unchanged guard would hide exactly the drift the nightly exists for, and weekly would delay it by up to seven days. The comment on the schedule says so.

Checked

• uvx --from actionlint-py actionlint exits 0 with the repo's .github/actionlint.yaml, and the pre-commit actionlint hook passes.
• No action was added or changed, so the SHA-pinned actions are untouched.
• This PR changes the workflows, so no filter skips it. It is opened as a draft: the draft run should show bandit and the dependency audit running and everything else skipped. Marking it ready is what starts the 46 jobs.

🤖 Generated with Claude Code