From a655edf2b834390e065d47dafb4377360ba69f52 Mon Sep 17 00:00:00 2001
From: Stefan Krawczyk <stefank@cs.stanford.edu>
Date: Sat, 2 May 2026 18:52:47 -0700
Subject: [PATCH 1/2] ci: fix required checks blocking Dependabot PRs

Remove paths-ignore from release-validation workflow and add a
check-paths job that detects whether the full validation should run.
When only docs/ or website/ files change, the build-artifacts and
install-and-smoke jobs are skipped rather than never triggered, which
satisfies branch protection required check requirements.
---
 .github/workflows/release-validation.yml | 35 +++++++++++++++++++-----
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release-validation.yml b/.github/workflows/release-validation.yml
index 375ff4dfa..6271cd80c 100644
--- a/.github/workflows/release-validation.yml
+++ b/.github/workflows/release-validation.yml
@@ -35,12 +35,6 @@ on:
       - 'v*.*.*-incubating-RC*'
   pull_request:
     types: [opened, synchronize, reopened]
-    paths-ignore:
-      - 'docs/**'
-      - 'website/**'
-      # Note: do NOT use '**/*.md' here. Some bundled examples ship .md files
-      # (e.g. examples/deployment/aws/terraform/tutorial.md) and a missing
-      # ASF header on those would cause a real RAT failure we want to catch.
   workflow_dispatch:
 
 concurrency:
@@ -51,8 +45,34 @@ permissions:
   contents: read
 
 jobs:
+  check-paths:
+    name: "Release Validation / check-paths"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      should_run: ${{ steps.check.outputs.should_run }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - id: check
+        run: |
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+          # If any changed file is outside docs/ and website/, run the full validation
+          if echo "$CHANGED" | grep -qvE '^(docs/|website/)'; then
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          fi
+
   build-artifacts:
     name: "Release Validation / build-artifacts"
+    needs: check-paths
+    if: needs.check-paths.outputs.should_run == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     outputs:
@@ -134,7 +154,8 @@ jobs:
 
   install-and-smoke:
     name: "Release Validation / install-and-smoke"
-    needs: build-artifacts
+    needs: [check-paths, build-artifacts]
+    if: needs.check-paths.outputs.should_run == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     strategy:

From a7e44890d735a9ddfe45e49836543fae4e29e745 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 3 May 2026 03:29:35 +0000
Subject: [PATCH 2/2] chore(deps): bump follow-redirects in /telemetry/ui
 (#739)

Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.5 to 1.16.0.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.5...v1.16.0)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 telemetry/ui/package-lock.json | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/telemetry/ui/package-lock.json b/telemetry/ui/package-lock.json
index 737eb8992..f7bef0048 100644
--- a/telemetry/ui/package-lock.json
+++ b/telemetry/ui/package-lock.json
@@ -13661,15 +13661,16 @@
       "integrity": "sha512-36yxDn5H7OFZQla0/jFJmbIKTdZAQHngCedGxiMmpNfEZM0sdEeT+WczLQrjK6D7o2aiyLYDnkw0R3JK0Qv1RQ=="
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.5",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.5.tgz",
-      "integrity": "sha512-vSFWUON1B+yAw1VN4xMfxgn5fTUiaOzAJCKBwIIgT/+7CuGy9+r+5gITvP62j3RmaD5Ph65UaERdOSRGUzZtgw==",
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
       "funding": [
         {
           "type": "individual",
           "url": "https://github.com/sponsors/RubenVerborgh"
         }
       ],
+      "license": "MIT",
       "engines": {
         "node": ">=4.0"
       },