ci: only run on specific paths

This avoids the previously applied paths-ignore exception workaround,
and makes runs as strict as (reasonably) possible. Only directories
known to affect builds will trigger builds, as well as any `.cpp` or
`.h` files to account for any new folders created - though these should
still be added to the workflow later

Signed-off-by: Seth Flynn <getchoo@tuta.io>

.github/workflows/nix.yml

@@ -4,34 +4,56 @@ on:
   push:
     tags:
       - "*"
-    # NOTE: `!` doesn't work with `paths-ignore` :(
-    # So we a catch-all glob instead
-    # https://github.com/orgs/community/discussions/25369#discussioncomment-3247674
     paths:
-      - "**"
-      - "!.github/**"
-      - ".github/workflows/nix.yml"
-      - "!flatpak/"
-      - "!scripts/"
+      # File types
+      - "**.cpp"
+      - "**.h"
+      - "**.java"
 
-      - "!.git*"
-      - "!.envrc"
-      - "!**.md"
+      # Build files
+      - "**.nix"
+      - "nix/"
+      - "flake.lock"
+
+      # Directories
+      - "buildconfig/"
+      - "cmake/"
+      - "launcher/"
+      - "libraries/"
+      - "program_info/"
+      - "tests/"
+
+      # Files
+      - "CMakeLists.txt"
       - "COPYING.md"
-      - "!renovate.json"
+
+      # Workflows
+      - ".github/workflows/nix.yml"
   pull_request_target:
     paths:
-      - "**"
-      - "!.github/**"
-      - ".github/workflows/nix.yml"
-      - "!flatpak/"
-      - "!scripts/"
+      # File types
+      - "**.cpp"
+      - "**.h"
 
-      - "!.git*"
-      - "!.envrc"
-      - "!**.md"
+      # Build files
+      - "**.nix"
+      - "nix/"
+      - "flake.lock"
+
+      # Directories
+      - "buildconfig/"
+      - "cmake/"
+      - "launcher/"
+      - "libraries/"
+      - "program_info/"
+      - "tests/"
+
+      # Files
+      - "CMakeLists.txt"
       - "COPYING.md"
-      - "!renovate.json"
+
+      # Workflows
+      - ".github/workflows/nix.yml"
   workflow_dispatch:
 
 permissions: