From bf460d10033b94e8f7f08ef2097ae4b0d2a6a732 Mon Sep 17 00:00:00 2001
From: luvs01 <luvs01@hanmail.net>
Date: Tue, 11 Aug 2026 09:35:26 +0900
Subject: [PATCH] fix(ci): verify repository automation changes

---
 .github/workflows/ci.yml   | 12 ++++--------
 tests/ci-workflows.test.ts |  9 ++++-----
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d0d017f1d..7d56bc19e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,8 @@ on:
       - "scripts/**"
       - "gui/**"
       - "assets/**"
+      - ".github/scripts/**"
+      - ".github/workflows/**"
       - ".gitattributes"
       - ".npmignore"
       - "package.json"
@@ -39,10 +41,6 @@ on:
       - "tsconfig.json"
       - "README.md"
       - "LICENSE"
-      - ".github/workflows/ci.yml"
-      - ".github/workflows/release.yml"
-      - ".github/workflows/enforce-pr-target.yml"
-      - ".github/workflows/stale-needs-info.yml"
   workflow_dispatch:
 
 permissions:
@@ -180,6 +178,8 @@ jobs:
               - 'scripts/**'
               - 'gui/**'
               - 'assets/**'
+              - '.github/scripts/**'
+              - '.github/workflows/**'
               - '.gitattributes'
               - '.npmignore'
               - 'package.json'
@@ -187,10 +187,6 @@ jobs:
               - 'tsconfig.json'
               - 'README.md'
               - 'LICENSE'
-              - '.github/workflows/ci.yml'
-              - '.github/workflows/release.yml'
-              - '.github/workflows/enforce-pr-target.yml'
-              - '.github/workflows/stale-needs-info.yml'
             gui:
               - 'gui/**'
             # Everything that ends up inside `npm pack`, or that decides what
diff --git a/tests/ci-workflows.test.ts b/tests/ci-workflows.test.ts
index 73bd08e71..8b7f02af7 100644
--- a/tests/ci-workflows.test.ts
+++ b/tests/ci-workflows.test.ts
@@ -301,13 +301,12 @@ describe("GitHub Actions hardening", () => {
 
     // The push trigger and pull-request `changes` job share one expensive-CI
     // allowlist. PRs always create the workflow and aggregate check; this list
-    // decides whether the costly jobs run. Pin the entire list on both paths.
+    // decides whether the costly jobs run. Pin the entire list on both paths,
+    // including every script and workflow used by repository automation.
     const ciPaths = [
       ".gitattributes",
-      ".github/workflows/ci.yml",
-      ".github/workflows/enforce-pr-target.yml",
-      ".github/workflows/release.yml",
-      ".github/workflows/stale-needs-info.yml",
+      ".github/scripts/**",
+      ".github/workflows/**",
       ".npmignore",
       "LICENSE",
       "README.md",