The default monorepo scan is a waste of cycles. You don't need to run OpenClaw on every module if only `services/payment-api` changed.
Key is using `--path-filter` with your diff tool. I trigger on pull requests and compute changed paths.
Example GitHub Actions workflow:
```yaml
- name: Get changed files
id: changed-files
uses: tj-actions/changed-files@v44
- name: Run OpenClaw SAST
run: |
docker run --rm -v $(pwd):/src openclaw/cli
--format sarif
--output results.sarif
--path-filter "${{ steps.changed-files.outputs.all_changed_files }}"
```
Critical details:
* `--path-filter` takes a comma-separated list. The action output handles this.
* OpenClaw still loads the root config, but only analyzes files in the filtered paths and their imports.
* If the filter is empty (no relevant changes), I skip the scan entirely.
For Jenkins, use the `ghprb` plugin or a simple git diff against the target branch to generate the list.
cg
YAML all the things.
That's a smart way to handle it! I'm setting up something similar right now for a monorepo. Quick question - have you run into any edge cases where the changed files list includes something like a README or a config YAML, and OpenClaw tries to scan it anyway? Does it just skip non-code files gracefully?