[naji247]

Summary

.github/workflows/ci.yml:

 on:
   push:
     branches: [main]
   pull_request:
   workflow_dispatch:
+  schedule:
+    - cron: '0 2 * * *'

 jobs:
+  changes:            # pull_request only; sets outputs.sdk from git diff base...head
+    if: github.event_name == 'pull_request'
   test: ...           # unchanged, runs on every PR
   release-build: ...  # unchanged, runs on every PR
   compat:
-    needs: test
+    needs: [changes, test]
+    if: >-
+      !cancelled() && needs.test.result == 'success' &&
+      (github.event_name != 'pull_request' || needs.changes.outputs.sdk == 'true')

SDK-code paths: src/** (main sources, tests, java-1x / java-018x compat test sources, test resources), pom.xml (manifest and build config, holds the compat profiles; Maven has no lockfile), .github/workflows/ci.yml. The workflow calls no scripts (scripts/Release.java belongs to release.yml).

Evidence

• Before: push to main, pull_request (all paths, compat always ran), workflow_dispatch; no schedule.
  After: same triggers plus schedule: '0 2 * * *'; on PRs, compat runs only when an SDK-code path changes. yaml.safe_load: OK. actionlint: not installed on the devbox, not run.

Merge Danger

Door: two-way

Blast Radius: CI

No required checks (rulesets empty, branch protection 404); job-level gating is used anyway because ci.yml also holds test and release-build, which still run on every PR. A docs-only PR now skips the 6 compat matrix jobs. release.yml waits only for the push run, so scheduled runs do not affect releases.