From 104d911a8669bef493081db0396e8746ce628524 Mon Sep 17 00:00:00 2001
From: chodeus <190988615+chodeus@users.noreply.github.com>
Date: Sat, 22 Aug 2026 11:22:34 +0800
Subject: [PATCH] ci: stop a workflow-only edit from republishing the images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This workflow listed itself in its push paths, and docker-push runs on push
events — so editing a comment in it rebuilt and republished :latest and :full.
Not a no-op either: BUILD_NUMBER is baked in as an ENV, so identical
application code still lands a fresh digest on both rolling tags, which is
exactly the churn renovate.json's own-image rule already complains about.

The pull_request trigger keeps the self-reference, so a workflow edit is still
exercised end to end (including Docker Validate) before it lands, and
validate-workflows.yml runs actionlint on it independently. workflow_dispatch
is there to force a run.

Verified by replaying the path filter over the commit that prompted this
(docs/deployment.md + renovate.json + this file): matches nothing now, while
backend/frontend/tests/Dockerfile/requirements-*.txt all still match.
---
 .github/workflows/codeql-lint.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql-lint.yml b/.github/workflows/codeql-lint.yml
index 705e4a98..cb161659 100644
--- a/.github/workflows/codeql-lint.yml
+++ b/.github/workflows/codeql-lint.yml
@@ -25,7 +25,13 @@ on:
       - '.dockerignore'
       - 'scripts/start.sh'
       - '.release-please-manifest.json'
-      - '.github/workflows/codeql-lint.yml'
+      # Deliberately NOT self-referential on push: docker-push runs on push
+      # events only, so a comment-level edit to this file used to rebuild and
+      # republish :latest and :full with a fresh digest (BUILD_NUMBER is baked
+      # in, so identical code still churns the tag). The pull_request trigger
+      # below KEEPS the self-reference, so a workflow edit is still exercised
+      # end to end before it lands — and actionlint (validate-workflows.yml)
+      # runs on it independently. Use workflow_dispatch to force a run.
   pull_request:
     branches:
       - '**'