perf(strix): skip scans on doc/image-only diffs and cap job at 60m

[seonghobae]

Problem

The org Strix security scan runs a ~120-minute scan per commit via pull_request_target and, by deliberate design, does not cancel in-progress scans on new commits (the concurrency group includes head.sha; cancel only on closed). That non-cancellation is a correct security property (an attacker must not be able to force-push a benign commit to cancel a malicious commit's scan). But the result is runner-queue starvation across the org: every doc-only, image-only, or empty re-trigger commit spawns a fresh 120-min scan, blocking all PR merges behind runner contention.

Fix (security-preserving throughput)

1. paths-ignore on push and pull_request_target for changes whose ENTIRE diff is non-executable documentation/image assets: *.md, *.markdown, *.rst, raster images (*.png/jpg/jpeg/gif/webp/bmp/ico), LICENSE*, COPYING, .github/ISSUE_TEMPLATE/**. A code security scanner has nothing to analyze in such a diff.

Conservative by design:

• Only file types/paths that cannot contain executable logic are listed.
• Not ignored: any source file, *.txt (could be a requirements/lock file), *.svg (can embed script), CODEOWNERS, *.html/*.css, and all build/workflow files.
• GitHub requires every changed file to match a paths-ignore pattern, so a PR/push touching even one code/config/build/workflow file still scans.

2. Cap the strix job at 60m (was 120m). The scan step is already hard-bounded to 30 min (timeout-minutes: 30 + STRIX_TOTAL_TIMEOUT_SECONDS=1800); every other step is quick or self-bounded. 120m only ever bit hung runs. 60m clears the realistic worst case (~50 min) with margin and is fail-closed (hitting the cap fails the run, never passes it).

Why coverage is preserved

• Skipped diffs contain zero executable code — nothing for a scanner to find.
• All-files-must-match semantics: any real code/config/build/workflow change still triggers a full scan.
• The weekly full-tree schedule (cron: 0 3 * * 1, no path filter) re-scans protected branches, backstopping every path.
• The merge scheduler still forces same-head Strix evidence via workflow_dispatch (which paths-ignore does not affect) before merging managed PRs, so merged code never loses evidence.
• The head.sha concurrency / cancel-in-progress security design is unchanged.

Validated with a YAML parser and actionlint (clean).

🤖 Generated with Claude Code