ci(e2e): trigger OAuth acceptance on relevant pull requests

.github/workflows/test-mcp-oauth-e2e.yml

@@ -1,6 +1,26 @@
 name: MCP OAuth happy path
 
 on:
+  pull_request:
+    paths:
+      - '.github/workflows/test-mcp-oauth-e2e.yml'
+      - '.github/e2e-stack/**'
+      - 'tests/e2e/*.py'
+      - 'tests/e2e/pytest.ini'
+      - 'tests/e2e/idp_realm.json'
+      - 'tests/e2e/mcp/**'
+      - 'litellm/experimental_mcp_client/**'
+      - 'litellm/proxy/_experimental/mcp_server/**'
+      - 'litellm/proxy/auth/**'
+      - 'litellm/proxy/management_endpoints/*sso*.py'
+      - 'litellm/proxy/management_endpoints/sso/**'
+      - 'litellm/proxy/common_utils/encrypt_decrypt_utils.py'
+      - 'litellm/proxy/proxy_server.py'
+      - 'litellm/proxy/schema.prisma'
+      - 'ui/litellm-dashboard/src/app/connect/**'
+      - 'ui/litellm-dashboard/src/app/mcp/oauth/**'
+      - 'pyproject.toml'
+      - 'uv.lock'
   workflow_dispatch:
 
 permissions: {}

tests/e2e/CONTRIBUTING.md

@@ -281,9 +281,16 @@ aggregate client never injects a gateway header; the explicitly labeled JWT
 variant configures `x-litellm-api-key` for the first consent and reconnects with
 only its gateway JWT after restart
 
-`.github/workflows/test-mcp-oauth-e2e.yml` runs the four cases in the protected
-`e2e-changed` environment. Provision `E2E_LINEAR_STORAGE_STATE_B64` as a secret
-there and retain the existing E2E license/AWS role configuration. A missing or
+`.github/workflows/test-mcp-oauth-e2e.yml` automatically requests a run for
+same-repository pull requests changing MCP, gateway authentication/SSO, consent
+UI, dependencies or the relevant E2E harness/workflow paths. It retains manual
+`workflow_dispatch` for targeted verification. The four cases run in the
+protected `e2e-changed` environment after its normal deployment approval;
+reviewers should approve and inspect this separate OAuth check when it appears.
+Fork pull requests do not run this credentialed job; use a reviewed
+same-repository branch for their verification. The workflow's path-filtered
+check is not configured here as a globally required branch-protection check.
+Provision `E2E_LINEAR_STORAGE_STATE_B64` as a secret there and retain the existing E2E license/AWS role configuration. A missing or
 expired session fails the job; collection, deselection and skips are not passes.
 The generic changed-test job excludes this file because it requires an owned
 proxy and consent UI. No LLM call is needed