[robbie-c]

Problem

• The five desktop CI workflows are the only workflows that run the upstream dorny/paths-filter action.
• chore(ci): migrate remaining paths-filter call sites to the vendored action #69171 moved every call site to the vendored copy in .github/actions/paths-filter. That gave the repo one change detector and removed the external supply-chain pin.
• The desktop import (chore(desktop): import PostHog/code into the monorepo #72483) and chore(ci): share desktop change detection across suites #126570 brought the upstream action back.

Changes

• desktop-ci, desktop-build, desktop-quality, desktop-test and desktop-typecheck run the vendored action. The desktop suites that a PR runs do not change.
• Each changes job gets a sparse checkout of .github/actions/paths-filter, because a local action must be on disk. The job gets contents: read for that checkout.
• The predicate-quantifier: every input goes away, because the vendored action has none.
• Each desktop filter has one include and some excludes. For that shape, every and the vendored include/exclude matching select the same files.
• Mechanical: the filters, the outputs, the app token and the job conditions do not change.

How did you test this code?

• bin/hogli lint:workflows, actionlint 1.7.12 and hogli test:workflows pass. The last one includes the test that keeps the desktop filters in sync.
• hogli ci:plan gives the same job table as master for all five workflows. The new checkout runs only in the scenarios where the filter step runs.
• The committed vendored bundle, run locally against the API, gave the same outputs that upstream logged on 75 desktop PRs since chore(ci): share desktop change detection across suites #126570. Five of those PRs matched at least one filter.
• The script skipped 32 runs, because the PR had new commits since the run or the log held no results.
• On chore(desktop): list every package ui may import in AGENTS.md #118072, chore(desktop): fix the announcements admin deploy recipe #117118 and chore(desktop): document the agent release process #102524, which changed only desktop docs, code and quality_code stay false. This checks the excludes.
• Not run in CI yet: the fallback detector in the four child workflows. It runs only when the desktop-ci detector fails, so this PR's run covers the desktop-ci detector alone.
• CI report, Trunk lane ⚠️: the lane rules give desktop-*.yml the desktop product's two lanes, py:product:desktop and fe:product:desktop. The report calls any lane set with a py: target the backend Python lane. No change to this diff moves it.

Test rationale: No new test. The workflow-plan suite already pins the desktop filters, and the comparison above checks the matching.

Release status

• No feature flag controls this change

Docs update

• None. No doc describes the desktop change detection.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /authoring-ci-workflows, /writing-pr-descriptions, /asd-ste100

• No duplicate: a search of open PRs found none.
• CodeRabbit: skipped.

More context for AI agents

• Session: the Claude Code session behind chore(ci): stop the rust crate version checks from timing out #127240 found the upstream action while it checked which change detector the repo approves.
• Decisions: the checkout step copies the filter step's if:, so a master push, a schedule or a dispatch run does not check out anything.
• Decisions: persist-credentials: false on the new checkouts, to match every other checkout in these files.
• Decisions: no new App token. The existing GH_APP_POSTHOG_PATHS_FILTER token goes to the vendored action through the same token input.

🤖 Generated with Claude Code

[trunk-io]

😎 Merged successfully - details.

[github-actions]

🤖 CI report

⚠️ Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

[hosthog]

HostHog preview — posthog-desktop-web

The previews for this PR have been torn down and no longer serve.

[parameterai]

Risk: No findings

This PR swaps the upstream dorny/paths-filter action for the repo-vendored copy in the five desktop CI workflows, adding a sparse, pinned checkout of the action directory and the minimal contents: read permission for it. I verified the dropped predicate-quantifier: every cannot skip suites: the vendored per-file include/exclude matching is a superset of every for these one-include-plus-excludes filters, so desktop jobs can only run more often, and the child workflows stay fail-closed when detection fails.

_{Sentinel reviewed 5296251 · Review settings}

[stamphog]

Not approved — this change needs a human reviewer.

Re-adding the stamphog label gives the same result unless the changed files change.

stamphog can't approve this pull request. The deny-list gate refused it because all five changed files (desktop-build.yml, desktop-ci.yml, desktop-quality.yml, desktop-test.yml and desktop-typecheck.yml) are CI workflow files under .github/workflows/. stamphog approves those paths only for authors on team-devex. The tier gate also classified the change as T2-never, so it is not eligible for automated review.

The next step is to ask a human reviewer, ideally someone on team-devex, to review this pull request.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✗	matches: ci_workflows (stamphog approves these paths only for authors on team-devex)
size	✓	55L, 5F substantive — within ceiling
tier	✗	classified as T2-never: T2-never (55L, 5F, single-area, chore)
stamphog 2.7.0		.stamphog/policy.yml @ unknown · reviewed head 5296251

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-11-02 21:59 UTC	Run
prod-us	✅ Deployed	2026-11-02 22:24 UTC	Run
prod-eu	✅ Deployed	2026-11-02 22:18 UTC	Run