Oliver Kieselbach 38b667799c ci: workflow-only commits no longer trigger CI and CodeQL ...

The 9eb8cac5 filters covered gitlink bumps and prose but not the
workflow files themselves, so every edit to build-agent.yml or a deploy
workflow still cost a full CI and CodeQL run. Neither reads any other
workflow: CI runs the suites and drift guards, CodeQL analyzes C# and
TypeScript. paths-ignore cannot negate, so each file lists the other
twelve workflows explicitly and leaves itself out; .github/scripts and,
for CI, .github/codeql join the list for the same reason.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-04 16:05:21 +02:00

..

bootstrap-script-gates.yml

ci(scripts): publish customer scripts on push, decoupled from the agent release

2026-08-19 15:09:33 +02:00

build-agent.yml

ci(agent): release body no longer repeats the release title

2026-09-04 16:01:52 +02:00

build-msi.yml

ci(msi): build from project dir - wix resolves File/@Source against cwd

2026-08-18 03:11:12 +02:00

ci.yml

ci: workflow-only commits no longer trigger CI and CodeQL

2026-09-04 16:05:21 +02:00

codeql.yml

ci: workflow-only commits no longer trigger CI and CodeQL

2026-09-04 16:05:21 +02:00

combine-rules.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

deploy-backend.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

deploy-mcp.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

deploy-web.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

indexnow-notify.yml

added valid return codes

2026-03-20 08:21:04 +01:00

oidc-login-test.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

pester.yml

ci(scripts): publish customer scripts on push, decoupled from the agent release

2026-08-19 15:09:33 +02:00

publish-scripts.yml

ci(scripts): publish customer scripts on push, decoupled from the agent release

2026-08-19 15:09:33 +02:00