From 7d64b94d7a713514c109a668d6dc7326996f841b Mon Sep 17 00:00:00 2001
From: Butler Agent <wayfinderak@wayfinderak.com>
Date: Fri, 11 Sep 2026 08:10:38 +0000
Subject: [PATCH 1/4] Scope documentation CI and isolate delivery job resources

---
 .gitea/workflows/build-image.yml | 11 +++++++++
 scripts/ci-select.sh             | 39 ++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 scripts/ci-select.sh

diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index 7215d24..5457e0f 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -9,5 +9,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Select relevant delivery work
+        id: delivery
+        env:
+          DELIVERY_EVENT: ${{ github.event_name }}
+          DELIVERY_REF: ${{ github.ref }}
+          DELIVERY_SHA: ${{ github.sha }}
+          DELIVERY_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          cd .
+          bash scripts/ci-select.sh
       - name: Build image
+        if: ${{ steps.delivery.outputs.run == 'true' }}
         run: make docker-build IMAGE_TAG=${{ gitea.sha }}
diff --git a/scripts/ci-select.sh b/scripts/ci-select.sh
new file mode 100644
index 0000000..7260b1b
--- /dev/null
+++ b/scripts/ci-select.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Keep required jobs alive; only skip reviewed non-runtime documentation paths.
+set -euo pipefail
+base="${DELIVERY_BASE:-}"
+head="$(git rev-parse HEAD)"
+run=true
+if [[ "${DELIVERY_REF:-}" != refs/tags/* && "$head" == "${DELIVERY_SHA:-}" && "${DELIVERY_EVENT:-}" =~ ^(push|pull_request)$ && "$base" =~ ^[0-9a-f]{40}$ && "$base" != 0000000000000000000000000000000000000000 ]]; then
+  if ! git cat-file -e "$base^{commit}" 2>/dev/null; then
+    if [[ -n "${DELIVERY_FETCH_TOKEN:-}" ]]; then
+      git -c "http.extraHeader=Authorization: token ${DELIVERY_FETCH_TOKEN}" fetch --quiet --depth=1 origin "$base" >/dev/null 2>&1 || true
+    else
+      git fetch --quiet --depth=1 origin "$base" >/dev/null 2>&1 || true
+    fi
+  fi
+  if git cat-file -e "$base^{commit}" 2>/dev/null; then
+    paths="$(mktemp)"
+    trap 'rm -f -- "$paths"' EXIT
+    # Snapshot comparison is conservative when main advanced during a PR.
+    # Both rename sides remain visible, including names containing newlines.
+    if git diff --no-renames --name-only -z "$base" "$head" > "$paths"; then
+      run=false
+      while IFS= read -r -d '' path; do
+        case "$path" in
+          README.md|CHANGELOG.md|LICENSE|LICENSE.md) ;;
+          *) run=true; break ;;
+        esac
+      done < "$paths"
+    fi
+  fi
+fi
+if [[ "$run" == false ]]; then
+  echo 'Only reviewed non-runtime documentation changed; build and validation are not applicable.'
+else
+  echo 'Runtime, unknown inputs, or unavailable event history: run required validation.'
+fi
+if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+  echo "run=$run" >> "$GITHUB_OUTPUT"
+fi
+printf '%s\n' "$run"
-- 
2.54.0


From 2cdd7585bb86802b25240fa07bd480c7b00271d9 Mon Sep 17 00:00:00 2001
From: Butler Agent <wayfinderak@wayfinderak.com>
Date: Fri, 11 Sep 2026 08:37:26 +0000
Subject: [PATCH 2/4] Run pull request validation once through native CI

---
 .gitea/workflows/build-image.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index 5457e0f..d798be9 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -2,11 +2,15 @@ name: build-image
 
 on:
   push:
-    branches: [main]
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
 
 jobs:
   docker:
-    runs-on: ubuntu-latest
+    runs-on: butler-ci
     steps:
       - uses: actions/checkout@v4
       - name: Select relevant delivery work
@@ -21,4 +25,5 @@ jobs:
           bash scripts/ci-select.sh
       - name: Build image
         if: ${{ steps.delivery.outputs.run == 'true' }}
-        run: make docker-build IMAGE_TAG=${{ gitea.sha }}
+        run: |
+          make ci-fast IMAGE_TAG=${{ gitea.sha }}
-- 
2.54.0


From 9c3e88c200b22ae0120378a6ae59c9514db356f9 Mon Sep 17 00:00:00 2001
From: Butler Agent <wayfinderak@wayfinderak.com>
Date: Fri, 11 Sep 2026 08:47:07 +0000
Subject: [PATCH 3/4] Cancel superseded pull request validation without
 cancelling releases

---
 .gitea/workflows/build-image.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index d798be9..a8e3606 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -8,6 +8,11 @@ on:
     branches:
     - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number
+    || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   docker:
     runs-on: butler-ci
-- 
2.54.0


From f27e14387d15be43eb8a09d3d13f591ca8daf01f Mon Sep 17 00:00:00 2001
From: Butler Agent <wayfinderak@wayfinderak.com>
Date: Fri, 11 Sep 2026 09:14:36 +0000
Subject: [PATCH 4/4] Resolve upstream Actions explicitly and check out the
 exact event revision

---
 .gitea/workflows/build-image.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index a8e3606..96846f9 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -17,7 +17,7 @@ jobs:
   docker:
     runs-on: butler-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://github.com/actions/checkout@v4
       - name: Select relevant delivery work
         id: delivery
         env:
-- 
2.54.0