Scope documentation CI and isolate delivery job resources

.gitea/workflows/build-and-push.yml

@@ -21,7 +21,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Select relevant delivery work
+        id: delivery
+        env:
+          DELIVERY_EVENT: ${{ github.event_name }}
+          DELIVERY_REF: ${{ github.ref }}
+          DELIVERY_SHA: ${{ github.sha }}
+          DELIVERY_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          cd .
+          bash scripts/ci-select.sh
       - name: Install Go and Docker CLI if needed
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -62,9 +73,11 @@ jobs:
           docker version
 
       - name: Run tests
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         run: go test ./...
 
       - name: Log in to Gitea Container Registry
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -79,6 +92,7 @@ jobs:
           exit 1
 
       - name: Determine image tags
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         id: meta
         shell: bash
         env:
@@ -109,6 +123,7 @@ jobs:
           printf 'EOF\n' >> "$GITHUB_OUTPUT"
 
       - name: Build image
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -124,6 +139,7 @@ jobs:
           docker build "${build_args[@]}" .
 
       - name: Push image
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         shell: bash
         run: |
           set -euo pipefail

scripts/ci-select.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Keep required jobs alive; only skip reviewed non-runtime documentation paths.
+set -euo pipefail
+base="${DELIVERY_BASE:-}"
+head="$(git rev-parse HEAD)"
+run=true
+if [[ "${DELIVERY_REF:-}" != refs/tags/* && "$head" == "${DELIVERY_SHA:-}" && "${DELIVERY_EVENT:-}" =~ ^(push|pull_request)$ && "$base" =~ ^[0-9a-f]{40}$ && "$base" != 0000000000000000000000000000000000000000 ]]; then
+  if ! git cat-file -e "$base^{commit}" 2>/dev/null; then
+    if [[ -n "${DELIVERY_FETCH_TOKEN:-}" ]]; then
+      git -c "http.extraHeader=Authorization: token ${DELIVERY_FETCH_TOKEN}" fetch --quiet --depth=1 origin "$base" >/dev/null 2>&1 || true
+    else
+      git fetch --quiet --depth=1 origin "$base" >/dev/null 2>&1 || true
+    fi
+  fi
+  if git cat-file -e "$base^{commit}" 2>/dev/null; then
+    paths="$(mktemp)"
+    trap 'rm -f -- "$paths"' EXIT
+    # Snapshot comparison is conservative when main advanced during a PR.
+    # Both rename sides remain visible, including names containing newlines.
+    if git diff --no-renames --name-only -z "$base" "$head" > "$paths"; then
+      run=false
+      while IFS= read -r -d '' path; do
+        case "$path" in
+          README.md|CHANGELOG.md|LICENSE|LICENSE.md) ;;
+          *) run=true; break ;;
+        esac
+      done < "$paths"
+    fi
+  fi
+fi
+if [[ "$run" == false ]]; then
+  echo 'Only reviewed non-runtime documentation changed; build and validation are not applicable.'
+else
+  echo 'Runtime, unknown inputs, or unavailable event history: run required validation.'
+fi
+if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+  echo "run=$run" >> "$GITHUB_OUTPUT"
+fi
+printf '%s\n' "$run"