ci: skip python heavy CI on Actions-only PRs (#6818)

Exclude .github/** from the code path filter used by tests, lint,
type-checker, and vulnerability-scan so workflow-only changes (including
CodeQL) do not run the Python matrix. CodeQL itself is unchanged and still
analyzes Actions YAML on those PRs.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>
Co-authored-by: Vidit Ostwal <110953813+Vidit-Ostwal@users.noreply.github.com>

.github/workflows/tests.yml

@@ -18,13 +18,14 @@ jobs:
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")
-          # so docs-only / markdown-only PRs correctly set code=false.
+          # so docs/markdown/Actions-only PRs correctly set code=false.
           predicate-quantifier: every
           filters: |
             code:
               - '**'
               - '!docs/**'
               - '!**/*.md'
+              - '!.github/**'
 
   tests-matrix:
     name: tests (${{ matrix.python-version }})
@@ -131,7 +132,7 @@ jobs:
       - name: Check results
         run: |
           if [ "${{ needs.changes.outputs.code }}" != "true" ]; then
-            echo "Docs-only change, skipping tests"
+            echo "Non-code change, skipping tests"
             exit 0
           fi
           if [ "${{ needs.tests-matrix.result }}" == "success" ]; then