Limit Molecule checks on new branches to changed roles

.github/workflows/molecule.yml

@@ -58,6 +58,7 @@ jobs:
           EVENT_NAME: ${{ github.event_name }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           BEFORE_SHA: ${{ github.event.before }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           INPUT_ROLE: ${{ inputs.role }}
         run: |
           set -euo pipefail
@@ -77,10 +78,12 @@ jobs:
             exit 0
           fi
 
-          # A hand-triggered run with no role named, and any run where the diff
-          # base is unusable (a new branch, a force push, the very first commit),
-          # falls back to every role that has a scenario. That is the safe
-          # direction to fail in: too much testing rather than too little.
+          # New branches have an all-zero before SHA. Compare them with their
+          # common ancestor with the default branch, so the first Renovate push
+          # tests only the roles it changes. The same fallback handles a force
+          # push whose previous commit is no longer available locally.
+          # Manual runs without a role, and pushes with no usable comparison,
+          # still consider every scenario.
           base=""
           case "${EVENT_NAME}" in
             pull_request) base="${BASE_SHA}" ;;
@@ -88,6 +91,8 @@ jobs:
               if [ -n "${BEFORE_SHA}" ] && [ "${BEFORE_SHA}" != "0000000000000000000000000000000000000000" ] \
                  && git cat-file -e "${BEFORE_SHA}^{commit}" 2>/dev/null; then
                 base="${BEFORE_SHA}"
+              elif [ -n "${DEFAULT_BRANCH}" ] && [ "${GITHUB_REF}" != "refs/heads/${DEFAULT_BRANCH}" ]; then
+                base="$(git merge-base HEAD "refs/remotes/origin/${DEFAULT_BRANCH}" || true)"
               fi
               ;;
           esac

docs/molecule-testing.md

@@ -28,7 +28,7 @@ Molecule is deliberately **not** part of the `prek` hooks. A run is far too slow
 
 `.github/workflows/molecule.yml` does not run every scenario on every push — with one repository holding every role, that would be unaffordable. Its first job works out which roles the push actually touched, keeps the ones that have a scenario, and builds the job matrix from those. A documentation change runs nothing.
 
-When the diff base cannot be determined (a new branch, a force push), it falls back to running every scenario, which errs toward testing too much rather than too little. `workflow_dispatch` accepts an optional role name.
+For pushes, CI compares against the previous commit. On a new branch, or when the previous commit is unavailable after a force push, it instead compares against the branch's common ancestor with the default branch. This keeps a new Renovate branch limited to the roles it changes. If no usable comparison exists, it falls back to running every scenario. Changes to `molecule-shared/` or the Molecule workflow also run every scenario. `workflow_dispatch` accepts an optional role name; leaving it empty runs every scenario.
 
 ## Automerge