[manuzhang]

Workflow-only dependency updates currently launch the general, AWS, SQL catalog, and sanitizer test suites. Scope their pull-request path filters so unrelated .github changes, such as an ASF allowlist action pin update, skip these suites.

Each suite still runs for its own workflow, shared local actions, and code/build changes; sanitizer suppression files also trigger sanitizer tests. Existing non-.github filtering and main/tag push triggers are preserved. Workflow security, allowlist, formatting, and license checks continue to run for workflow-only updates.

Validation:

• Applicable pre-commit hooks and full online zizmor 1.30.1 audit at CI thresholds.
• Fifteen trigger scenarios covering allowlist-only, unrelated workflow/configuration, docs, source/build/CI scripts, each suite's own workflow, shared actions, sanitizer suppressions, and mixed changes.
• Checked all tracked paths to confirm non-.github trigger behavior is preserved; git diff --check.

The allowlist action upgrade is kept separate in #1047. This PR changes the test workflows themselves, so those suites are expected to run here to validate their changes.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wgtmac]

I was thinking about restricting workflows such as aws, sql-catalog and hive-catalog to be triggered only when files under certain subdirectories are affected. Then use something like https://github.com/peter-evans/slash-command-dispatch to enable maintainers/reviewers to manually trigger one workflow if necessary.

[shangxinli]

lgtm