ci: stop a workflow-only edit from republishing the images

[chodeus]

Summary

This workflow listed itself in its own push paths, and docker-push runs on push events — so a comment-level edit to this file rebuilt and republished :latest and :full. That is what happened on eec28cd (a docs commit), which is what prompted this.

It is not a harmless no-op either: BUILD_NUMBER=$(git rev-list --count HEAD) is baked in as an ENV, so identical application code still lands a fresh digest on both rolling tags — the exact churn renovate.json's own-image rule already complains about.

Related issue

N/A — fallout from eec28cd.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (config migration, schema, endpoint, or UI behavior)
• Docs only
• Refactor / internal cleanup

What is deliberately kept

The pull_request trigger keeps the self-reference, so a workflow edit is still exercised end to end — including Docker Validate (PR), which builds the image without pushing it — before it lands. validate-workflows.yml runs actionlint on it independently, and workflow_dispatch is there to force a run.

The alternative shape — a paths-filter step gating docker-push — was rejected: it adds conditional logic plus a fail-safe branch to a publishing job, where a wrong filter means images silently stop publishing. Removing one trigger entry cannot fail that way.

Testing

Replayed the real path filter (GitHub glob semantics: ** spans separators, * does not) over two known-answer cases:

• eec28cd, the docs commit that caused the needless republish — .github/workflows/codeql-lint.yml, docs/deployment.md, renovate.json — now matches nothing.
• A representative code change — backend/util/cl2k/renderer.py, frontend/src/pages/poster/Cl2kMakerPage.jsx, tests/test_cl2k_mirror.py, deploy/docker/Dockerfile, requirements-cl2k.txt — still matches all five, so publishing is untouched for anything that can change the image.

Downstream consumers audited for the loosened trigger: nothing chains off this workflow (no workflow_run anywhere); notify-failure only needs: its siblings; branch-protection required checks are evaluated on pull requests, whose trigger is unchanged; CodeQL still runs on every code push plus the weekly cron; and release images are unaffected because release-please.yml triggers on push: [main] with no paths filter and its own docker-version job.

actionlint reports the same 4 pre-existing shellcheck infos before and after — none introduced.

Screenshots

N/A.

Checklist

• Config schema updated if applicable — N/A
• Frontend builds cleanly — N/A, no frontend change
• No new DAPS references introduced
• Docs / wiki drafts updated if behavior or shape changed
• CHANGELOG entry added for user-visible changes — none; ci: is not user-visible

Summary by CodeRabbit

• Chores
  • Updated automated workflow triggers to prevent workflow-only changes from publishing Docker images.
  • Preserved validation for pull requests and documented the available manual execution option.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 59540576-6f9c-475a-8442-decb065543a5

📥 Commits

Reviewing files that changed from the base of the PR and between eec28cd and 104d911.

📒 Files selected for processing (1)

• .github/workflows/codeql-lint.yml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The CodeQL workflow no longer includes its own file in push path filters. Pull-request coverage remains enabled, and comments document Docker publishing behavior and manual dispatch.

Changes

CodeQL workflow triggers

Layer / File(s)	Summary
Push trigger filter .github/workflows/codeql-lint.yml	The push path filters exclude the workflow file. Pull-request coverage remains enabled. Comments document Docker publishing behavior and manual dispatch.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 104d9

This change prevents workflow-only edits from republishing rolling images while preserving pull-request validation and publishing for image-affecting changes. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main CI change: workflow-only edits no longer republish Docker images.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/no-republish-on-workflow-edit

---

_{Comment @coderabbitai help to get the list of available commands.}

[chodeus]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.