Resolve upstream Actions explicitly and check out the exact event revision

.butler/README.md

@@ -0,0 +1,5 @@
+# Service release contract
+
+Butler resolves this repository's protected source revision to verified immutable images. The platform updates only image references in the existing production Compose file and restarts only the already running application services. It preserves current environment, storage, routes, and provider configuration. It retains previous application images and restores them if readiness fails.
+
+Migration and maintenance images are pinned when declared, but this release operation does not run database migrations or maintenance jobs. A release requiring a schema change needs the corresponding explicit platform migration first. No homelab image-pin commit is required for an ordinary compatible application release.

.butler/deployment.json

@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "deployment": "geeksbot-release",
+  "environment": "production",
+  "images": {
+    "geeksbot_release_geeksbot_image": {
+      "name": "geeksbot",
+      "tag": "sha-{revision}"
+    }
+  },
+  "revision_variable": "geeksbot_release_revision"
+}

.gitea/workflows/build-and-push.yml

@@ -3,15 +3,22 @@ name: Build and Push Container
 on:
   push:
     branches:
-      - master
-      - main
+    - master
     tags:
-      - v*
-  workflow_dispatch:
+    - v*
+  workflow_dispatch: null
+  pull_request:
+    branches:
+    - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number
+    || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build-and-push:
-    runs-on: ubuntu-latest
+    runs-on: butler-ci
     env:
       REGISTRY: gitea.wayfinderak.com
       IMAGE_NAME: gitea.wayfinderak.com/wayfinderak/geeksbot
@@ -19,9 +26,20 @@ jobs:
       options: --dns 172.16.30.10
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: https://github.com/actions/checkout@v4
 
+      - name: Select relevant delivery work
+        id: delivery
+        env:
+          DELIVERY_EVENT: ${{ github.event_name }}
+          DELIVERY_REF: ${{ github.ref }}
+          DELIVERY_SHA: ${{ github.sha }}
+          DELIVERY_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          cd .
+          bash scripts/ci-select.sh
       - name: Install Go and Docker CLI if needed
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -62,9 +80,11 @@ jobs:
           docker version
 
       - name: Run tests
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         run: go test ./...
 
       - name: Log in to Gitea Container Registry
+        if: ${{ (steps.delivery.outputs.run == 'true') && github.event_name != 'pull_request' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -79,6 +99,7 @@ jobs:
           exit 1
 
       - name: Determine image tags
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         id: meta
         shell: bash
         env:
@@ -87,7 +108,7 @@ jobs:
           SHA: ${{ gitea.sha }}
         run: |
           set -euo pipefail
-          tags=()
+          tags=("$IMAGE_NAME:sha-$SHA")
 
           if [[ "$REF" == refs/tags/* ]]; then
             version="$REF_NAME"
@@ -109,6 +130,7 @@ jobs:
           printf 'EOF\n' >> "$GITHUB_OUTPUT"
 
       - name: Build image
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -121,9 +143,10 @@ jobs:
             build_args+=(--tag "$tag")
           done
 
-          docker build "${build_args[@]}" .
+          docker build --label "org.opencontainers.image.revision=$GITHUB_SHA" "${build_args[@]}" .
 
       - name: Push image
+        if: ${{ (steps.delivery.outputs.run == 'true') && github.event_name != 'pull_request' }}
         shell: bash
         run: |
           set -euo pipefail

.gitignore

@@ -1,2 +1,4 @@
 .env
 .idea
+
+portainer-app.env

portainer-app.env

@@ -1,3 +0,0 @@
-DATABASE_URL=postgresql://geeksbot:kW6JzIQhBi4r7rRcKi3l2ct4@10.0.0.202:5432/geeksbot
-DISCORD_TOKEN=Mzk2NTg4OTk2NzA2MzA0MDEw.GybJWT.KYhcnh1Zn72splQaEW92A4GmM13Au9d40t4qtI
-STEAM_API_KEY=A8309D7186F7E523E83972CA0A92C486

portainer-app.env.example

@@ -0,0 +1,3 @@
+DATABASE_URL=postgresql://USER:PASSWORD@HOST:5432/geeksbot?sslmode=disable
+DISCORD_TOKEN=replace-me
+STEAM_API_KEY=replace-me

scripts/ci-select.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Keep required jobs alive; only skip reviewed non-runtime documentation paths.
+set -euo pipefail
+base="${DELIVERY_BASE:-}"
+head="$(git rev-parse HEAD)"
+run=true
+if [[ "${DELIVERY_REF:-}" != refs/tags/* && "$head" == "${DELIVERY_SHA:-}" && "${DELIVERY_EVENT:-}" =~ ^(push|pull_request)$ && "$base" =~ ^[0-9a-f]{40}$ && "$base" != 0000000000000000000000000000000000000000 ]]; then
+  if ! git cat-file -e "$base^{commit}" 2>/dev/null; then
+    if [[ -n "${DELIVERY_FETCH_TOKEN:-}" ]]; then
+      git -c "http.extraHeader=Authorization: token ${DELIVERY_FETCH_TOKEN}" fetch --quiet --depth=1 origin "$base" >/dev/null 2>&1 || true
+    else
+      git fetch --quiet --depth=1 origin "$base" >/dev/null 2>&1 || true
+    fi
+  fi
+  if git cat-file -e "$base^{commit}" 2>/dev/null; then
+    paths="$(mktemp)"
+    trap 'rm -f -- "$paths"' EXIT
+    # Snapshot comparison is conservative when main advanced during a PR.
+    # Both rename sides remain visible, including names containing newlines.
+    if git diff --no-renames --name-only -z "$base" "$head" > "$paths"; then
+      run=false
+      while IFS= read -r -d '' path; do
+        case "$path" in
+          README.md|CHANGELOG.md|LICENSE|LICENSE.md) ;;
+          *) run=true; break ;;
+        esac
+      done < "$paths"
+    fi
+  fi
+fi
+if [[ "$run" == false ]]; then
+  echo 'Only reviewed non-runtime documentation changed; build and validation are not applicable.'
+else
+  echo 'Runtime, unknown inputs, or unavailable event history: run required validation.'
+fi
+if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+  echo "run=$run" >> "$GITHUB_OUTPUT"
+fi
+printf '%s\n' "$run"