When a workflow is skipped because of a path filter, branch filter or commit message, GitHub leaves its required checks in a Pending state, and the pull request cannot merge. A job skipped by a condition inside a running workflow reports Success instead. Knowing that difference stops both stuck merges and silent gate gaps.
What GitHub documents
From GitHub's troubleshooting page for required status checks:
- If a workflow is skipped due to path filtering, branch filtering or a commit message, the associated checks stay Pending and block merging.
- If a job is skipped because of a conditional, it reports Success.
- A job skipped because it depends on a failed job may not block merging. To make a required check enforce the result, use always() together with needs.
GitHub's advice for the first case is to avoid requiring workflows that can be skipped.
Two different problems
| Symptom | Cause | Risk |
|---|---|---|
| Merge blocked, check pending forever | Workflow-level filter skipped the whole workflow | Annoyance, people start using admin bypass |
| Merge allowed with no scan | Job-level condition skipped, reported Success | A security check never ran but looks green |
The second is the dangerous one. If your dependency scan only runs when a certain condition holds, and a condition misfire skips it, the required check passes anyway.
Path filter details to know
From the workflow syntax reference: with a paths filter, the workflow runs if at least one changed file matches. Path filters are not evaluated for tag pushes. A push with more than 1,000 commits always runs. If a diff has more than 3,000 files and the matching files are not among the first 3,000, the workflow does not run.
How to fix it
- Keep security workflows unfiltered. Run the scan on every pull request. The cost of a skipped scan is higher than the minutes saved.
- Use one required aggregator job that always runs and depends on the others with always() and needs, then fails if any needed job failed or was skipped when it should not have been.
- Require the aggregator, not the individual checks. That way a renamed or filtered job cannot leave a required check dangling.
- Do not use admin bypass as the fix for a stuck check. Fix the workflow.
Try it yourself
Click through it at your own pace, or open it full screen. Watch what the pull request status shows when a check passes and when it fails.
Quick check
Why does my skipped job show a green tick?
Jobs skipped by a conditional report Success. If the job matters, make the condition always true for security checks.
Can I require a workflow that only runs on some paths?
You can, but GitHub warns it will stay Pending when skipped. Avoid it.
Safeguard policies and gates on pull requests are designed to evaluate every change. You can try the free scan first.
Sources
Last reviewed: 19 October 2026.
