From 85100c46237b1fb4ac2a85e74474f950fbb31668 Mon Sep 17 00:00:00 2001
From: Sebastian Bernauer <sebastian.bernauer@stackable.tech>
Date: Thu, 27 Nov 2025 12:12:46 +0100
Subject: [PATCH 01/24] docs: Improve Hive 4 warning

---
 docs/modules/hive/partials/supported-versions.adoc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/modules/hive/partials/supported-versions.adoc b/docs/modules/hive/partials/supported-versions.adoc
index 3ec74a45..bab1d495 100644
--- a/docs/modules/hive/partials/supported-versions.adoc
+++ b/docs/modules/hive/partials/supported-versions.adoc
@@ -12,7 +12,10 @@
 Hive 4 has known compatibility issues, especially when using it with Iceberg or Trino.
 The missing compatibility with Iceberg also means that Spark jobs using this storage may fail.
 
-**Workaround:** If you encounter issues with Hive 4, use Hive 3.1.3 instead until these upstream issues are resolved.
+Be aware of upgrading Hive (e.g. 4.0.0 to 4.0.1 or 4.0.1 to Hive 4.1.0), as this upgrade is not easily reversible.
+Test the new version before upgrading your production workloads and take backups of your database.
+
+**Workaround:** If you encounter issues with Hive 4.x, use Hive 3.1.3 instead until these upstream issues are resolved.
 
 For more details, see:
 

From 547ec63c0938c7f3c5d59b19a61503daa6795532 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 11:26:50 +0100
Subject: [PATCH 02/24] chi(wip): Get changed files list

---
 .github/workflows/build.yaml | 437 +++++++++++++++++++----------------
 1 file changed, 232 insertions(+), 205 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index c68f8e0d..d5da63d3 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -18,15 +18,15 @@ on:
     # Run every Saturday morning: https://crontab.guru/#15_3_*_*_6
     - cron: '15 3 * * 6'
   pull_request:
-    paths:
-      - '.github/workflows/build.yaml'
-      - 'rust-toolchain.toml'
-      - '.dockerignore'
-      - 'deploy/**'
-      - '.cargo/**'
-      - 'docker/**'
-      - 'Cargo.*'
-      - '*.rs'
+    # paths:
+    #   - '.github/workflows/build.yaml'
+    #   - 'rust-toolchain.toml'
+    #   - '.dockerignore'
+    #   - 'deploy/**'
+    #   - '.cargo/**'
+    #   - 'docker/**'
+    #   - 'Cargo.*'
+    #   - '*.rs'
   merge_group:
 
 env:
@@ -37,230 +37,257 @@ env:
   HADOLINT_VERSION: "v2.14.0"
   PYTHON_VERSION: "3.14"
   CARGO_TERM_COLOR: always
+  BASE_SHA: ${{ github.event.pull_request.base.sha }}
+  HEAD_SHA: ${{ github.event.pull_request.head.sha }}
 
 jobs:
-  cargo-udeps:
-    name: Run cargo-udeps
+  # This workflow contains a "required job", and GitHub Actions isn't clever
+  # enough to detect that it should be skipped, and therefore pass (like they
+  # allow for skipping jobs in a workflow).
+  # Therefore, we have to move path filters/globs down to an actual job, and
+  # emit an output that can be used to skip irrelevant jobs.
+  path-filter:
+    name: Testing path filters
     runs-on: ubuntu-latest
-    env:
-      RUSTC_BOOTSTRAP: 1
     steps:
-      - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
-        with:
-          packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
-          version: ubuntu-latest
-
       - name: Checkout Repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
           submodules: recursive
+      - shell: bash
+        run: |
+          git log --name-only --pretty=format: "${BASE_SHA}..${HEAD_SHA}"
 
-      - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+  # cargo-udeps:
+  #   name: Run cargo-udeps
+  #   needs: [path-filter]
+  #   runs-on: ubuntu-latest
+  #   env:
+  #     RUSTC_BOOTSTRAP: 1
+  #   steps:
+  #     - name: Install host dependencies
+  #       uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
+  #       with:
+  #         packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
+  #         version: ubuntu-latest
 
-      - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
-        with:
-          cache-all-crates: "true"
-          key: udeps
+  #     - name: Checkout Repository
+  #       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+  #       with:
+  #         persist-credentials: false
+  #         submodules: recursive
 
-      - name: Install cargo-udeps
-        uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps
+  #     - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
+  #       uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
+  #       with:
+  #         toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
 
-      - name: Run cargo-udeps
-        run: cargo udeps --workspace --all-targets
+  #     - name: Setup Rust Cache
+  #       uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+  #       with:
+  #         cache-all-crates: "true"
+  #         key: udeps
 
-  build-container-image:
-    name: Build/Publish ${{ matrix.runner.arch }} Image
-    if: github.event_name != 'merge_group'
-    permissions:
-      id-token: write
-    strategy:
-      fail-fast: false
-      matrix:
-        runner:
-          - { name: "ubuntu-latest", arch: "amd64" }
-          - { name: "ubicloud-standard-8-arm", arch: "arm64" }
-    runs-on: ${{ matrix.runner.name }}
-    outputs:
-      operator-version: ${{ steps.version.outputs.OPERATOR_VERSION }}
-    steps:
-      - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
-        with:
-          packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
-          version: ${{ matrix.runner.name }}
+  #     - name: Install cargo-udeps
+  #       uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps
 
-      - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
-          submodules: recursive
+  #     - name: Run cargo-udeps
+  #       run: cargo udeps --workspace --all-targets
 
-      - name: Update/Extract Operator Version
-        id: version
-        env:
-          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          GITHUB_EVENT_NAME: ${{ github.event_name }}
-          GITHUB_DEBUG: ${{ runner.debug }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          [ -n "$GITHUB_DEBUG" ] && set -x
+  # build-container-image:
+  #   name: Build/Publish ${{ matrix.runner.arch }} Image
+  #   needs: [path-filter]
+  #   if: github.event_name != 'merge_group'
+  #   permissions:
+  #     id-token: write
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       runner:
+  #         - { name: "ubuntu-latest", arch: "amd64" }
+  #         - { name: "ubicloud-standard-8-arm", arch: "arm64" }
+  #   runs-on: ${{ matrix.runner.name }}
+  #   outputs:
+  #     operator-version: ${{ steps.version.outputs.OPERATOR_VERSION }}
+  #   steps:
+  #     - name: Install host dependencies
+  #       uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
+  #       with:
+  #         packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
+  #         version: ${{ matrix.runner.name }}
 
-          CURRENT_VERSION=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[0].version')
+  #     - name: Checkout Repository
+  #       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+  #       with:
+  #         persist-credentials: false
+  #         submodules: recursive
 
-          if [ "$GITHUB_EVENT_NAME" == 'pull_request' ]; then
-            # Include a PR suffix if this workflow is triggered by a PR
-            if [ "$PR_BASE_REF" == 'main' ]; then
-              NEW_VERSION="0.0.0-pr$PR_NUMBER"
-            else
-              NEW_VERSION="$CURRENT_VERSION-pr$PR_NUMBER"
-            fi
-          else
-            # Just use the current version if this workflow is run on push, schedule, etc...
-            NEW_VERSION="$CURRENT_VERSION"
-          fi
+  #     - name: Update/Extract Operator Version
+  #       id: version
+  #       env:
+  #         PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
+  #         PR_NUMBER: ${{ github.event.pull_request.number }}
+  #         GITHUB_EVENT_NAME: ${{ github.event_name }}
+  #         GITHUB_DEBUG: ${{ runner.debug }}
+  #       shell: bash
+  #       run: |
+  #         set -euo pipefail
+  #         [ -n "$GITHUB_DEBUG" ] && set -x
 
-          sed -i "s/version = \"${CURRENT_VERSION}\"/version = \"${NEW_VERSION}\"/" Cargo.toml
-          echo "OPERATOR_VERSION=$NEW_VERSION" | tee -a "$GITHUB_OUTPUT"
+  #         CURRENT_VERSION=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[0].version')
 
-      - name: Install Nix
-        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
+  #         if [ "$GITHUB_EVENT_NAME" == 'pull_request' ]; then
+  #           # Include a PR suffix if this workflow is triggered by a PR
+  #           if [ "$PR_BASE_REF" == 'main' ]; then
+  #             NEW_VERSION="0.0.0-pr$PR_NUMBER"
+  #           else
+  #             NEW_VERSION="$CURRENT_VERSION-pr$PR_NUMBER"
+  #           fi
+  #         else
+  #           # Just use the current version if this workflow is run on push, schedule, etc...
+  #           NEW_VERSION="$CURRENT_VERSION"
+  #         fi
 
-      - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+  #         sed -i "s/version = \"${CURRENT_VERSION}\"/version = \"${NEW_VERSION}\"/" Cargo.toml
+  #         echo "OPERATOR_VERSION=$NEW_VERSION" | tee -a "$GITHUB_OUTPUT"
 
-      - name: Build Container Image
-        id: build
-        uses: stackabletech/actions/build-container-image@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
-        with:
-          image-name: ${{ env.OPERATOR_NAME }}
-          image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }}
-          build-arguments: VERSION=${{ steps.version.outputs.OPERATOR_VERSION }}
-          container-file: docker/Dockerfile
+  #     - name: Install Nix
+  #       uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
 
-      - name: Publish Container Image
-        uses: stackabletech/actions/publish-image@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
-        with:
-          image-registry-uri: oci.stackable.tech
-          image-registry-username: robot$sdp+github-action-build
-          image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
-          image-repository: sdp/${{ env.OPERATOR_NAME }}
-          image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
-          source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}
+  #     - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
+  #       uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
+  #       with:
+  #         toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
 
-  publish-index-manifest:
-    name: Publish/Sign ${{ needs.build-container-image.outputs.operator-version }} Index
-    if: github.event_name != 'merge_group'
-    needs:
-      - build-container-image
-    permissions:
-      id-token: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+  #     - name: Build Container Image
+  #       id: build
+  #       uses: stackabletech/actions/build-container-image@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
+  #       with:
+  #         image-name: ${{ env.OPERATOR_NAME }}
+  #         image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }}
+  #         build-arguments: VERSION=${{ steps.version.outputs.OPERATOR_VERSION }}
+  #         container-file: docker/Dockerfile
 
-      - name: Publish and Sign Image Index
-        uses: stackabletech/actions/publish-image-index-manifest@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
-        with:
-          image-registry-uri: oci.stackable.tech
-          image-registry-username: robot$sdp+github-action-build
-          image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
-          image-repository: sdp/${{ env.OPERATOR_NAME }}
-          image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
+  #     - name: Publish Container Image
+  #       uses: stackabletech/actions/publish-image@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
+  #       with:
+  #         image-registry-uri: oci.stackable.tech
+  #         image-registry-username: robot$sdp+github-action-build
+  #         image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
+  #         image-repository: sdp/${{ env.OPERATOR_NAME }}
+  #         image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
+  #         source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}
 
-  publish-helm-chart:
-    name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart
-    if: github.event_name != 'merge_group'
-    needs:
-      - build-container-image
-    permissions:
-      id-token: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
-          submodules: recursive
+  # publish-index-manifest:
+  #   name: Publish/Sign ${{ needs.build-container-image.outputs.operator-version }} Index
+  #   if: github.event_name != 'merge_group'
+  #   needs:
+  #     - path-filter
+  #     - build-container-image
+  #   permissions:
+  #     id-token: write
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: Checkout Repository
+  #       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+  #       with:
+  #         persist-credentials: false
 
-      - name: Package, Publish, and Sign Helm Chart
-        uses: stackabletech/actions/publish-helm-chart@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
-        with:
-          chart-registry-uri: oci.stackable.tech
-          chart-registry-username: robot$sdp-charts+github-action-build
-          chart-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}
-          chart-repository: sdp-charts
-          chart-directory: deploy/helm/${{ env.OPERATOR_NAME }}
-          chart-version: ${{ needs.build-container-image.outputs.operator-version }}
-          app-version: ${{ needs.build-container-image.outputs.operator-version }}
+  #     - name: Publish and Sign Image Index
+  #       uses: stackabletech/actions/publish-image-index-manifest@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
+  #       with:
+  #         image-registry-uri: oci.stackable.tech
+  #         image-registry-username: robot$sdp+github-action-build
+  #         image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
+  #         image-repository: sdp/${{ env.OPERATOR_NAME }}
+  #         image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
 
-  openshift-preflight-check:
-    name: Run OpenShift Preflight Check for ${{ needs.build-container-image.outputs.operator-version }}-${{ matrix.arch }}
-    if: github.event_name != 'merge_group'
-    needs:
-      - build-container-image
-      - publish-index-manifest
-    strategy:
-      fail-fast: false
-      matrix:
-        arch:
-          - amd64
-          - arm64
-    runs-on: ubuntu-latest
-    steps:
-      - name: Run OpenShift Preflight Check
-        uses: stackabletech/actions/run-openshift-preflight@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
-        with:
-          image-index-uri: oci.stackable.tech/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
-          image-architecture: ${{ matrix.arch }}
+  # publish-helm-chart:
+  #   name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart
+  #   if: github.event_name != 'merge_group'
+  #   needs:
+  #     - path-filter
+  #     - build-container-image
+  #   permissions:
+  #     id-token: write
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: Checkout Repository
+  #       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+  #       with:
+  #         persist-credentials: false
+  #         submodules: recursive
 
-  # This job is a required check in GitHub Settings for this repository.
-  # It saves us having to list many required jobs, or work around dynamically
-  # named jobs (since there is no concept of required settings).
-  finished:
-    # WARNING: Do not change the name unless you will also be changing the
-    # Required Checks (in branch protections) in GitHub settings.
-    name: Finished Build and Publish
-    needs:
-      - cargo-udeps
-      - openshift-preflight-check
-      - publish-helm-chart
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "We are done here"
+  #     - name: Package, Publish, and Sign Helm Chart
+  #       uses: stackabletech/actions/publish-helm-chart@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
+  #       with:
+  #         chart-registry-uri: oci.stackable.tech
+  #         chart-registry-username: robot$sdp-charts+github-action-build
+  #         chart-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}
+  #         chart-repository: sdp-charts
+  #         chart-directory: deploy/helm/${{ env.OPERATOR_NAME }}
+  #         chart-version: ${{ needs.build-container-image.outputs.operator-version }}
+  #         app-version: ${{ needs.build-container-image.outputs.operator-version }}
 
-  notify:
-    name: Failure Notification
-    if: (failure() || github.run_attempt > 1) && github.event_name != 'merge_group'
-    needs:
-      - build-container-image
-      - publish-index-manifest
-      - publish-helm-chart
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+  # openshift-preflight-check:
+  #   name: Run OpenShift Preflight Check for ${{ needs.build-container-image.outputs.operator-version }}-${{ matrix.arch }}
+  #   if: github.event_name != 'merge_group'
+  #   needs:
+  #     - path-filter
+  #     - build-container-image
+  #     - publish-index-manifest
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       arch:
+  #         - amd64
+  #         - arm64
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: Run OpenShift Preflight Check
+  #       uses: stackabletech/actions/run-openshift-preflight@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
+  #       with:
+  #         image-index-uri: oci.stackable.tech/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
+  #         image-architecture: ${{ matrix.arch }}
 
-      - name: Send Notification
-        uses: stackabletech/actions/send-slack-notification@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
-        with:
-          publish-helm-chart-result: ${{ needs.publish-helm-chart.result }}
-          publish-manifests-result: ${{ needs.publish-index-manifest.result }}
-          build-result: ${{ needs.build-container-image.result }}
-          slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
-          channel-id: C07UG6JH44F # notifications-container-images
-          type: container-image-build
+  # # This job is a required check in GitHub Settings for this repository.
+  # # It saves us having to list many required jobs, or work around dynamically
+  # # named jobs (since there is no concept of required settings).
+  # finished:
+  #   # WARNING: Do not change the name unless you will also be changing the
+  #   # Required Checks (in branch protections) in GitHub settings.
+  #   name: Finished Build and Publish
+  #   needs:
+  #     - path-filter
+  #     - cargo-udeps
+  #     - openshift-preflight-check
+  #     - publish-helm-chart
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - run: echo "We are done here"
+
+  # notify:
+  #   name: Failure Notification
+  #   if: (failure() || github.run_attempt > 1) && github.event_name != 'merge_group'
+  #   needs:
+  #     - path-filter
+  #     - build-container-image
+  #     - publish-index-manifest
+  #     - publish-helm-chart
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: Checkout Repository
+  #       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+  #       with:
+  #         persist-credentials: false
+
+  #     - name: Send Notification
+  #       uses: stackabletech/actions/send-slack-notification@29bea1b451c0c2e994bd495969286f95bf49ed6a # v0.11.0
+  #       with:
+  #         publish-helm-chart-result: ${{ needs.publish-helm-chart.result }}
+  #         publish-manifests-result: ${{ needs.publish-index-manifest.result }}
+  #         build-result: ${{ needs.build-container-image.result }}
+  #         slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+  #         channel-id: C07UG6JH44F # notifications-container-images
+  #         type: container-image-build

From f003873b593b1d61cfb493b417e1e6d03744d921 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 11:29:07 +0100
Subject: [PATCH 03/24] itsame

---
 .github/workflows/build.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d5da63d3..9f0ab27b 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -55,6 +55,7 @@ jobs:
         with:
           persist-credentials: false
           submodules: recursive
+          depth: 0
       - shell: bash
         run: |
           git log --name-only --pretty=format: "${BASE_SHA}..${HEAD_SHA}"

From 9f56549fd9d5b73b6ad75e2df1521d472bca4746 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 11:30:12 +0100
Subject: [PATCH 04/24] mario

---
 .github/workflows/pr_pre-commit.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/pr_pre-commit.yaml b/.github/workflows/pr_pre-commit.yaml
index acbc963e..e947e42e 100644
--- a/.github/workflows/pr_pre-commit.yaml
+++ b/.github/workflows/pr_pre-commit.yaml
@@ -3,6 +3,8 @@ name: pre-commit
 
 on:
   pull_request:
+    paths:
+      - omg
   merge_group:
 
 env:

From a98b7fc55f0230f25735e82a0e3e0944a582b0a1 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 11:33:35 +0100
Subject: [PATCH 05/24] itsa

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 9f0ab27b..87058426 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -58,7 +58,7 @@ jobs:
           depth: 0
       - shell: bash
         run: |
-          git log --name-only --pretty=format: "${BASE_SHA}..${HEAD_SHA}"
+          git diff --name-only "${BASE_SHA}..${HEAD_SHA}"
 
   # cargo-udeps:
   #   name: Run cargo-udeps

From b439e398f3347b90b94b31baa5ffb9810d737422 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 11:35:59 +0100
Subject: [PATCH 06/24] gooda show

---
 .github/workflows/build.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 87058426..266e7611 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -38,7 +38,6 @@ env:
   PYTHON_VERSION: "3.14"
   CARGO_TERM_COLOR: always
   BASE_SHA: ${{ github.event.pull_request.base.sha }}
-  HEAD_SHA: ${{ github.event.pull_request.head.sha }}
 
 jobs:
   # This workflow contains a "required job", and GitHub Actions isn't clever
@@ -58,7 +57,7 @@ jobs:
           depth: 0
       - shell: bash
         run: |
-          git diff --name-only "${BASE_SHA}..${HEAD_SHA}"
+          git diff --name-only "${BASE_SHA}.."
 
   # cargo-udeps:
   #   name: Run cargo-udeps

From 45309f406e8b2ac3841e80e823241aa6edc31c6d Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 11:36:46 +0100
Subject: [PATCH 07/24] running out of material

---
 .github/workflows/build.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 266e7611..c7f0c035 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -57,6 +57,7 @@ jobs:
           depth: 0
       - shell: bash
         run: |
+          git branch -a
           git diff --name-only "${BASE_SHA}.."
 
   # cargo-udeps:

From c69f89786be0011ac775549049a8300cc1435920 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 11:38:11 +0100
Subject: [PATCH 08/24] hjdbs

---
 .github/workflows/build.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index c7f0c035..dcdf8157 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -57,6 +57,7 @@ jobs:
           depth: 0
       - shell: bash
         run: |
+          git fetch
           git branch -a
           git diff --name-only "${BASE_SHA}.."
 

From d5d9cab6118518110dd9decfce2c55416f89ee22 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 11:39:58 +0100
Subject: [PATCH 09/24] srfgedkuhbvsbrksvrneio;t

---
 .github/workflows/build.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index dcdf8157..9754d61a 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -54,10 +54,9 @@ jobs:
         with:
           persist-credentials: false
           submodules: recursive
-          depth: 0
+          fetch-depth: 0
       - shell: bash
         run: |
-          git fetch
           git branch -a
           git diff --name-only "${BASE_SHA}.."
 

From f242ae83c14045240d00ba5538d096b0055d0f30 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 11:46:57 +0100
Subject: [PATCH 10/24] yq version

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 9754d61a..352f1c38 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -57,7 +57,7 @@ jobs:
           fetch-depth: 0
       - shell: bash
         run: |
-          git branch -a
+          yq --version
           git diff --name-only "${BASE_SHA}.."
 
   # cargo-udeps:

From 9c6f9311e729cb94383cfa73e53b02c25abab0ac Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 12:04:12 +0100
Subject: [PATCH 11/24] lessgo

---
 .github/workflows/build.yaml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 352f1c38..f26b9c66 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -57,8 +57,23 @@ jobs:
           fetch-depth: 0
       - shell: bash
         run: |
-          yq --version
-          git diff --name-only "${BASE_SHA}.."
+          # - '.github/workflows/build.yaml'
+          # - 'rust-toolchain.toml'
+          # - '.dockerignore'
+          # - 'deploy/**'
+          # - '.cargo/**'
+          # - 'docker/**'
+          # - 'Cargo.*'
+          # - '*.rs'
+
+          # Temp globs
+          # The action will need to get this from inputs somehow
+          readarray GLOBS < <(yq --output-format=json --indent=0 --null-input '["*.adoc", ".github/**"]')
+
+          for GLOB in "${GLOBS[@]}"; do
+              echo "$GLOB"
+              git diff --name-only "${BASE_SHA}.." -- "$GLOB"
+          done
 
   # cargo-udeps:
   #   name: Run cargo-udeps

From a8d1176a11fcfe39b276408fa8400064a905c7b7 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 12:05:24 +0100
Subject: [PATCH 12/24] whaayyyyy

---
 .github/workflows/build.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f26b9c66..a6460663 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -57,6 +57,7 @@ jobs:
           fetch-depth: 0
       - shell: bash
         run: |
+          set -x
           # - '.github/workflows/build.yaml'
           # - 'rust-toolchain.toml'
           # - '.dockerignore'

From 72274d9c75defdeb12cbf7d36ef74a90bf83b849 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 12:12:07 +0100
Subject: [PATCH 13/24] tsv?

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index a6460663..ccbf8ffc 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -69,7 +69,7 @@ jobs:
 
           # Temp globs
           # The action will need to get this from inputs somehow
-          readarray GLOBS < <(yq --output-format=json --indent=0 --null-input '["*.adoc", ".github/**"]')
+          readarray GLOBS < <(yq --output-format=tsv --null-input '["*.adoc", ".github/**"]')
 
           for GLOB in "${GLOBS[@]}"; do
               echo "$GLOB"

From db3ea93122860e21ba479fc36af95637bdd36b77 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 12:16:17 +0100
Subject: [PATCH 14/24] tabsssss

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index ccbf8ffc..1d1aaedc 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -69,7 +69,7 @@ jobs:
 
           # Temp globs
           # The action will need to get this from inputs somehow
-          readarray GLOBS < <(yq --output-format=tsv --null-input '["*.adoc", ".github/**"]')
+          readarray -d $'\t' GLOBS < <(yq --output-format=tsv --null-input '["*.adoc", ".github/**"]')
 
           for GLOB in "${GLOBS[@]}"; do
               echo "$GLOB"

From 204c0a4214f024dde1992bfd16a9e14dd4f26482 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 12:23:12 +0100
Subject: [PATCH 15/24] shipit

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 1d1aaedc..c8eb1217 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -69,7 +69,7 @@ jobs:
 
           # Temp globs
           # The action will need to get this from inputs somehow
-          readarray -d $'\t' GLOBS < <(yq --output-format=tsv --null-input '["*.adoc", ".github/**"]')
+          readarray -t -d $'\t' GLOBS < <(yq --output-format=tsv --null-input '["*.adoc", ".github/**"]')
 
           for GLOB in "${GLOBS[@]}"; do
               echo "$GLOB"

From 5f47feaabe5d5c24d3d8175941095c3c028e5b71 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 12:48:32 +0100
Subject: [PATCH 16/24] cursed AF

---
 .github/workflows/build.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index c8eb1217..7e33b045 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -69,10 +69,10 @@ jobs:
 
           # Temp globs
           # The action will need to get this from inputs somehow
-          readarray -t -d $'\t' GLOBS < <(yq --output-format=tsv --null-input '["*.adoc", ".github/**"]')
+          # This is cursed... we use `.[] | .` to remove quotes and any yaml formatting.
+          readarray -t GLOBS < <(yq --null-input '["*.adoc", ".github/**"]' | yq '.[] | .')
 
           for GLOB in "${GLOBS[@]}"; do
-              echo "$GLOB"
               git diff --name-only "${BASE_SHA}.." -- "$GLOB"
           done
 

From eca4db6a05173051b44059cdbc2bdabb597a8c6a Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 13:03:17 +0100
Subject: [PATCH 17/24] are we ci yet?

---
 .github/workflows/build.yaml | 75 +++++++++++++++++++++---------------
 1 file changed, 43 insertions(+), 32 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 7e33b045..f4108ddf 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -55,7 +55,8 @@ jobs:
           persist-credentials: false
           submodules: recursive
           fetch-depth: 0
-      - shell: bash
+      - id: check
+        shell: bash
         run: |
           set -x
           # - '.github/workflows/build.yaml'
@@ -72,45 +73,55 @@ jobs:
           # This is cursed... we use `.[] | .` to remove quotes and any yaml formatting.
           readarray -t GLOBS < <(yq --null-input '["*.adoc", ".github/**"]' | yq '.[] | .')
 
+          MATCHED="false"
           for GLOB in "${GLOBS[@]}"; do
-              git diff --name-only "${BASE_SHA}.." -- "$GLOB"
+              if ! git diff --exit-code --name-only "${BASE_SHA}.." -- "$GLOB"; then
+                # When git diff exist with an error, that means there was a diff
+                # for the glob.
+                MATCHED="true"
+              fi
           done
 
-  # cargo-udeps:
-  #   name: Run cargo-udeps
-  #   needs: [path-filter]
-  #   runs-on: ubuntu-latest
-  #   env:
-  #     RUSTC_BOOTSTRAP: 1
-  #   steps:
-  #     - name: Install host dependencies
-  #       uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
-  #       with:
-  #         packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
-  #         version: ubuntu-latest
+          echo "MATCHED=$MATCHED" | tee -a "$GITHUB_OUTPUT"
+    outputs:
+      matched: ${{ steps.check.outputs.MATCHED }}
 
-  #     - name: Checkout Repository
-  #       uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-  #       with:
-  #         persist-credentials: false
-  #         submodules: recursive
+  cargo-udeps:
+    name: Run cargo-udeps
+    needs: [path-filter]
+    if: needs.path-filter.outputs.matched == 'true'
+    runs-on: ubuntu-latest
+    env:
+      RUSTC_BOOTSTRAP: 1
+    steps:
+      - name: Install host dependencies
+        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
+        with:
+          packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
+          version: ubuntu-latest
 
-  #     - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
-  #       uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-  #       with:
-  #         toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+      - name: Checkout Repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+          submodules: recursive
 
-  #     - name: Setup Rust Cache
-  #       uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
-  #       with:
-  #         cache-all-crates: "true"
-  #         key: udeps
+      - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
+        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+
+      - name: Setup Rust Cache
+        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+        with:
+          cache-all-crates: "true"
+          key: udeps
 
-  #     - name: Install cargo-udeps
-  #       uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps
+      - name: Install cargo-udeps
+        uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps
 
-  #     - name: Run cargo-udeps
-  #       run: cargo udeps --workspace --all-targets
+      - name: Run cargo-udeps
+        run: cargo udeps --workspace --all-targets
 
   # build-container-image:
   #   name: Build/Publish ${{ matrix.runner.arch }} Image

From 2ed5b6951f8e742eaa7bae2760f83a1329dc3af6 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 13:04:29 +0100
Subject: [PATCH 18/24] assume skipped

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f4108ddf..de58191f 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -71,7 +71,7 @@ jobs:
           # Temp globs
           # The action will need to get this from inputs somehow
           # This is cursed... we use `.[] | .` to remove quotes and any yaml formatting.
-          readarray -t GLOBS < <(yq --null-input '["*.adoc", ".github/**"]' | yq '.[] | .')
+          readarray -t GLOBS < <(yq --null-input '["*.rs", ".cargo/**"]' | yq '.[] | .')
 
           MATCHED="false"
           for GLOB in "${GLOBS[@]}"; do

From a86af69a6f21bd11fdec356dedbbcc9f9441bb50 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Mon, 1 Dec 2025 14:29:27 +0100
Subject: [PATCH 19/24] ci: Use dedicated action

---
 .github/actions/path-filter/action.yaml | 34 ++++++++++++++++++
 .github/workflows/build.yaml            | 48 +++++++++----------------
 2 files changed, 51 insertions(+), 31 deletions(-)
 create mode 100644 .github/actions/path-filter/action.yaml

diff --git a/.github/actions/path-filter/action.yaml b/.github/actions/path-filter/action.yaml
new file mode 100644
index 00000000..1bf2f06b
--- /dev/null
+++ b/.github/actions/path-filter/action.yaml
@@ -0,0 +1,34 @@
+name: path-filter
+description: Detect changed files by provideding a list of glob patterns
+inputs:
+  patterns:
+    description: A list of glob patterns to check for changes. Defaults to '*'.
+    default: "*"
+outputs:
+  matched:
+    description: Returns if any changed files were matched by the provided glob patterns.
+    value: ${{ steps.check.outputs.MATCHED }}
+runs:
+  using: composite
+  steps:
+    - name: Check for changed files
+      id: check
+      shell: bash
+      env:
+        PATTERNS: ${{ inputs.patterns }}
+      run: |
+        set -euo pipefail
+
+        # This is cursed... we use `.[] | .` to remove quotes and any yaml formatting.
+        readarray -t GLOBS < <(echo -n "$PATTERNS" | yq '.[] | .')
+
+        MATCHED="false"
+        for GLOB in "${GLOBS[@]}"; do
+            if ! git diff --exit-code --name-only "${BASE_SHA}.." -- "$GLOB"; then
+              # When git diff exist with an error, that means there was a diff
+              # for the glob.
+              MATCHED="true"
+            fi
+        done
+
+        echo "MATCHED=$MATCHED" | tee -a "$GITHUB_OUTPUT"
\ No newline at end of file
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index de58191f..f6f20261 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -12,11 +12,11 @@ on:
     branches:
       - main
     tags:
-      - '[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+'
-      - '[0-9][0-9].[0-9]+.[0-9]+'
+      - "[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+"
+      - "[0-9][0-9].[0-9]+.[0-9]+"
   schedule:
     # Run every Saturday morning: https://crontab.guru/#15_3_*_*_6
-    - cron: '15 3 * * 6'
+    - cron: "15 3 * * 6"
   pull_request:
     # paths:
     #   - '.github/workflows/build.yaml'
@@ -55,36 +55,22 @@ jobs:
           persist-credentials: false
           submodules: recursive
           fetch-depth: 0
-      - id: check
-        shell: bash
-        run: |
-          set -x
-          # - '.github/workflows/build.yaml'
-          # - 'rust-toolchain.toml'
-          # - '.dockerignore'
-          # - 'deploy/**'
-          # - '.cargo/**'
-          # - 'docker/**'
-          # - 'Cargo.*'
-          # - '*.rs'
 
-          # Temp globs
-          # The action will need to get this from inputs somehow
-          # This is cursed... we use `.[] | .` to remove quotes and any yaml formatting.
-          readarray -t GLOBS < <(yq --null-input '["*.rs", ".cargo/**"]' | yq '.[] | .')
-
-          MATCHED="false"
-          for GLOB in "${GLOBS[@]}"; do
-              if ! git diff --exit-code --name-only "${BASE_SHA}.." -- "$GLOB"; then
-                # When git diff exist with an error, that means there was a diff
-                # for the glob.
-                MATCHED="true"
-              fi
-          done
-
-          echo "MATCHED=$MATCHED" | tee -a "$GITHUB_OUTPUT"
+      - name: Check for changed files
+        id: check
+        uses: ./.github/actions/path-filter
+        with:
+          patterns: |
+            - '.github/workflows/build.yaml'
+            - 'rust-toolchain.toml'
+            - '.dockerignore'
+            - 'deploy/**'
+            - '.cargo/**'
+            - 'docker/**'
+            - 'Cargo.*'
+            - '*.rs'
     outputs:
-      matched: ${{ steps.check.outputs.MATCHED }}
+      matched: ${{ steps.check.outputs.matched }}
 
   cargo-udeps:
     name: Run cargo-udeps

From 162dfc3453a79031c60e25526bfa8ae796d7ab24 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 14:54:40 +0100
Subject: [PATCH 20/24] test remote action

---
 .github/workflows/build.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f6f20261..a3b26415 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -58,7 +58,7 @@ jobs:
 
       - name: Check for changed files
         id: check
-        uses: ./.github/actions/path-filter
+        uses: stackabletech/actions/detect-changes@9905bf868e085ec530e6e5b35065023669432123 # vx.x.x
         with:
           patterns: |
             - '.github/workflows/build.yaml'
@@ -70,7 +70,7 @@ jobs:
             - 'Cargo.*'
             - '*.rs'
     outputs:
-      matched: ${{ steps.check.outputs.matched }}
+      matched: ${{ steps.check.outputs.detected }}
 
   cargo-udeps:
     name: Run cargo-udeps

From a5d93098882351a1fcb96dbcd99ebcdc08995313 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 15:10:56 +0100
Subject: [PATCH 21/24] test fixes

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index a3b26415..53107783 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -58,7 +58,7 @@ jobs:
 
       - name: Check for changed files
         id: check
-        uses: stackabletech/actions/detect-changes@9905bf868e085ec530e6e5b35065023669432123 # vx.x.x
+        uses: stackabletech/actions/detect-changes@9584f617fe2a114a789f90281fe0abd73f3c91b5 # vx.x.x
         with:
           patterns: |
             - '.github/workflows/build.yaml'

From 1482bf511753bcc44927cbdeb2fbb06df6ba926a Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 15:12:13 +0100
Subject: [PATCH 22/24] test without a pattern

Should match all changes
---
 .github/workflows/build.yaml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 53107783..a6fb939e 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -59,16 +59,6 @@ jobs:
       - name: Check for changed files
         id: check
         uses: stackabletech/actions/detect-changes@9584f617fe2a114a789f90281fe0abd73f3c91b5 # vx.x.x
-        with:
-          patterns: |
-            - '.github/workflows/build.yaml'
-            - 'rust-toolchain.toml'
-            - '.dockerignore'
-            - 'deploy/**'
-            - '.cargo/**'
-            - 'docker/**'
-            - 'Cargo.*'
-            - '*.rs'
     outputs:
       matched: ${{ steps.check.outputs.detected }}
 

From fc87c8ea75f1ea88c8314f6dde4081763cb1dd51 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 15:14:23 +0100
Subject: [PATCH 23/24] let's see

---
 .github/workflows/build.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index a6fb939e..4a2667e5 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -11,13 +11,15 @@ on:
   push:
     branches:
       - main
+      - ci/fix-path-filter
     tags:
       - "[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+"
       - "[0-9][0-9].[0-9]+.[0-9]+"
   schedule:
     # Run every Saturday morning: https://crontab.guru/#15_3_*_*_6
     - cron: "15 3 * * 6"
-  pull_request:
+  # pull_request:
+    # We cannot use path filters here, because this workflow contains a "required job".
     # paths:
     #   - '.github/workflows/build.yaml'
     #   - 'rust-toolchain.toml'
@@ -37,7 +39,6 @@ env:
   HADOLINT_VERSION: "v2.14.0"
   PYTHON_VERSION: "3.14"
   CARGO_TERM_COLOR: always
-  BASE_SHA: ${{ github.event.pull_request.base.sha }}
 
 jobs:
   # This workflow contains a "required job", and GitHub Actions isn't clever

From fc7e4b3b3ec350558dad48e9082c03adeb185c13 Mon Sep 17 00:00:00 2001
From: Nick Larsen <nick.larsen@stackable.tech>
Date: Mon, 1 Dec 2025 15:16:27 +0100
Subject: [PATCH 24/24] this time

---
 .github/workflows/build.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 4a2667e5..82f01d98 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -59,7 +59,7 @@ jobs:
 
       - name: Check for changed files
         id: check
-        uses: stackabletech/actions/detect-changes@9584f617fe2a114a789f90281fe0abd73f3c91b5 # vx.x.x
+        uses: stackabletech/actions/detect-changes@a1ab9bf951cf97728f0efaa58ba2105ad955e2e3 # vx.x.x
     outputs:
       matched: ${{ steps.check.outputs.detected }}