Jesse_Chen
534f5e617c
Twenty-four of the last sixty staging pushes were pure documentation, yet each one ran (and cancelled) the full gate and image publish. Introduce deploy/gated-paths.txt as the single source of truth for what must rerun the gate: every Dockerfile COPY source, the Python package inputs, the workflow and build-context files, and the repository files frontend/tests read at gate time. Both triggers of backend-quality-gate.yml now carry that exact list; pushes that touch none of it neither run the gate nor cancel a running code gate. Because staging head may then legitimately sit ahead of the last tested SHA, add deploy/is-docs-only-range.sh: it proves <base> is an ancestor of <head> and that no changed path matches a gated glob, from local history when it is available and otherwise from the Gitea compare API (per-commit `files`, parent walk for ancestry, total_commits cross-checked). The publish dispatch and the deploy-staging head checks accept an advanced head only when that script succeeds; diverged, older, or code-bearing heads are still refused. In deploy-staging the check runs after the gate-attested controller bundle is extracted so only the tested checker and path list are ever executed; the manual rollback branch is unchanged. AGENTS.md §6.3/§6.4 describe the new contract: `.deployment.gitCommit` must equal the latest staging commit that touched a gated path, not staging head. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VawU7Xfd5jS9wUEXz1XYmS
33 lines
998 B
Plaintext
33 lines
998 B
Plaintext
# Paths whose changes must rerun the staging quality gate and republish images.
|
|
# Single source of truth for the `paths:` filters of both triggers in
|
|
# .gitea/workflows/backend-quality-gate.yml and for deploy/is-docs-only-range.sh.
|
|
# One glob per line (GitHub/Gitea filter syntax: `*` stops at `/`, `**` does not);
|
|
# `#` comments and blank lines are ignored. A push whose every changed file falls
|
|
# outside this list is docs-only: no gate, no image, no deployment. When in doubt,
|
|
# list the path here rather than leave it out.
|
|
#
|
|
# Workflow and build-context inputs
|
|
.dockerignore
|
|
.gitea/**
|
|
.github/workflows/**
|
|
#
|
|
# Python package inputs (pyproject.toml / MANIFEST.in / `python -m build`)
|
|
MANIFEST.in
|
|
mcp_server.py
|
|
pyproject.toml
|
|
requirements*.txt
|
|
jyotish_vedic/**
|
|
scripts/**
|
|
tests/**
|
|
#
|
|
# Image inputs (deploy/railway-api.Dockerfile, deploy/railway-web.Dockerfile)
|
|
SKILL.md
|
|
assets/**
|
|
references/**
|
|
skills/**
|
|
deploy/**
|
|
frontend/**
|
|
#
|
|
# Repository files read by frontend/tests at gate time
|
|
contracts/**
|