Enable ci-build.yml as required check with multi-job architecture for doc changes

[Copilot]

Plan: Update ci-build.yml to Support Required Branch Checks

• Remove paths-ignore filters from PR and push triggers
• Add a step to detect if only documentation files were changed
• Conditionally skip build steps when only docs changed
• Ensure the workflow always runs and completes successfully
• Validate the YAML syntax
• Address code review feedback (edge cases, robustness)
• Final code review
• Run security checks (CodeQL - 0 alerts)
• Fix git safe directory configuration order (build failure)
• Refactor into multi-job architecture for resource efficiency

Implementation Complete ✅

The workflow now uses a 3-job architecture for optimal resource usage:

Job Architecture

1. check-changes (ubuntu-22.04): Lightweight job that detects documentation-only changes and determines build template
2. build (custom 1ES agent): Only runs when code changes detected (job-level if condition); performs full Yocto build
3. status-check (ubuntu-22.04): Gate job that always runs and determines overall success

Key Features

• Always runs on PRs and pushes to main/kirkstone
• Detects documentation-only changes dynamically
• Avoids spinning up expensive build agent for docs-only changes
• Build job completely skipped (not just steps) when only docs changed
• Gate job ensures workflow always completes with proper status
• Handles edge cases (first commit, empty files, etc.)
• Clean code without step-level conditionals

Benefits

✅ Resource efficient: Saves expensive build agent resources for docs-only PRs
✅ Cleaner code: No step-level conditionals cluttering the workflow
✅ Required check compatible: Can be safely added to branch protection rules
✅ Always completes: Gate job ensures status is always reported

Original prompt

I want to update the ci-build.yml pipeline so that it:

1. Still doesn't execute a build when the only changes are markdown files
2. But it can be added as a required check in the branch policies for main.
   Today, ci-build.yml doesn't run when the PR only touches markdown files (due to the ignore-paths property in the PR trigger), so if I were to make it a required check on all PRs, some PRs would be stuck waiting for the check to pass. Can you make a PR that works around this problem in a simple, sensible way?

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.