fix(ci): gate language jobs on their project entry point on diff runs too

[jdfalk]

Summary

The reusable CI's detect-changes job only checked whether a matching file belongs to a buildable project on forced runs. On a normal PR diff, any matching file started the language job, which then failed:

• any .js, .css or .html file started frontend-ci, even with no package.json;
• any .rs file started rust-ci, even with no root Cargo.toml;
• any .py file started python-ci, even with no Python package.

This blocked falkcorp/cockroach-rollout-agent#34. It is a Rust binary that embeds a static app.js and app.css, has no package.json, and failed Frontend CI on every PR touching them.

Issues Addressed

fix(ci): gate language jobs on their project entry point on diff runs too

Description: The three checks move out of the forced-run Inventory tracked files step into a new Gate categories on their project entry points step. It runs on both diff and forced runs and reads the raw paths-filter or inventory result. Get frontend working directory now always runs, so the gate resolves package.json exactly where frontend-ci would install from. The job outputs and the debug summary for rust-files, python-files and frontend-files now come from the gate. The other categories are unchanged.

Files Modified:

• .github/workflows/reusable-ci.yml: the new gate step. The inventory step now only records raw hits. The header is bumped to 1.17.0.
• .github/guid-index.json: the version bump, regenerated by the pre-commit hook.
• changelog.d/20261011-entry-point-gate-diff-runs.md: changelog fragment.

Testing

• actionlint v1.7.1 (the version this workflow pins) is clean on the file.
• I extracted the gate step's script and ran it against real checkouts:

Checkout	Inputs	Result
cockroach-rollout-agent	all three categories changed	rust true, python false, frontend false (no package.json)
github-common	all three categories changed	rust false (no root Cargo.toml), python true, frontend true
either	nothing changed	all three false

Breaking Changes

None intended. Repos that do have the entry point behave exactly as before. Repos without it now skip a job that could only fail.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P2coHXurAM9VQCm1XCHxnS