Scope CI and deployment to affected files

.github/workflows/aur.yml

@@ -0,0 +1,102 @@
+name: AUR Checks
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/aur.yml"
+      - "packaging/aur/**"
+      - "scripts/render-aur-pkgbuild.sh"
+      - "scripts/verify-aur-source-package.sh"
+      - "scripts/verify-aur-git-package.sh"
+      - "scripts/ci-impact.rb"
+      - "scripts/test-ci-impact.rb"
+      - "scripts/test-ci-workflow-paths.rb"
+      - "!**/*.md"
+  push:
+    branches: [master, main]
+    paths:
+      - ".github/workflows/aur.yml"
+      - "packaging/aur/**"
+      - "scripts/render-aur-pkgbuild.sh"
+      - "scripts/verify-aur-source-package.sh"
+      - "scripts/verify-aur-git-package.sh"
+      - "scripts/ci-impact.rb"
+      - "scripts/test-ci-impact.rb"
+      - "scripts/test-ci-workflow-paths.rb"
+      - "apps/desktop/**"
+      - "packages/**"
+      - "packaging/common/**"
+      - "scripts/package-release.sh"
+      - "scripts/restore-background.mjs"
+      - "scripts/detect-audio-backends.mjs"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.base.json"
+      - ".npmrc"
+      - "!**/*.md"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Check affected inputs
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      run: ${{ steps.scope.outputs.run }}
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - id: scope
+        name: Check paths and dependency impact
+        run: ruby scripts/ci-impact.rb application .github/workflows/aur.yml
+
+  validate-aur-source:
+    name: Build source AUR packages on Arch Linux
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
+    concurrency:
+      group: aur-checks-${{ github.ref }}
+      cancel-in-progress: true
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Build and inspect source package
+        env:
+          LOOPWIRE_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          set -euo pipefail
+          release_tag="$(git describe --tags --abbrev=0 --match 'v[0-9]*')"
+          export LOOPWIRE_AUR_VERSION="${release_tag#v}"
+          export LOOPWIRE_AUR_GIT_VERSION="$(
+            git describe --long --tags --abbrev=7 "origin/$LOOPWIRE_DEFAULT_BRANCH" |
+              sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
+          )"
+          docker run --rm \
+            --env LOOPWIRE_AUR_VERSION \
+            --env LOOPWIRE_AUR_GIT_VERSION \
+            --env LOOPWIRE_DEFAULT_BRANCH \
+            --volume "$GITHUB_WORKSPACE:/workspace:ro" \
+            archlinux@sha256:84cd9ef000b3cff245ec028e87965b84724f4bf1cc63fc2741ba927b88515ed6 \
+            bash -ceu '
+              pacman -Syu --noconfirm --needed \
+                curl git namcap nodejs pipewire pnpm rust webkit2gtk-4.1 wireplumber
+              useradd --create-home aur-builder
+              runuser -u aur-builder -- env HOME=/home/aur-builder \
+                bash /workspace/scripts/verify-aur-source-package.sh \
+                  --version "$LOOPWIRE_AUR_VERSION"
+              runuser -u aur-builder -- env HOME=/home/aur-builder \
+                bash /workspace/scripts/verify-aur-git-package.sh \
+                  --version "$LOOPWIRE_AUR_GIT_VERSION" \
+                  --default-branch "$LOOPWIRE_DEFAULT_BRANCH"
+            '

.github/workflows/ci.yml

@@ -2,21 +2,86 @@ name: CI
 
 on:
   pull_request:
+    paths:
+      - ".github/workflows/ci.yml"
+      - "apps/desktop/**"
+      - "packages/**"
+      - "packaging/**"
+      - "scripts/**"
+      - "vm/**"
+      - "flake.nix"
+      - "flake.lock"
+      - ".cargo/**"
+      - "rust-toolchain*"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.base.json"
+      - ".npmrc"
+      - "!**/*.md"
+      - "!scripts/*docs*"
+      - "!scripts/build-static-site.mjs"
+      - "!scripts/verify-static-site.mjs"
+      - "!scripts/e2e-site-install.mjs"
+      - "!scripts/verify-github-workflows.sh"
+      - "!scripts/verify-requirements.sh"
+      - "!scripts/setup-github-actions.mjs"
+      - "!scripts/test-setup-github-actions.mjs"
   push:
-    branches:
-      - master
-      - main
+    branches: [master, main]
+    paths:
+      - ".github/workflows/ci.yml"
+      - "apps/desktop/**"
+      - "packages/**"
+      - "packaging/**"
+      - "scripts/**"
+      - "vm/**"
+      - "flake.nix"
+      - "flake.lock"
+      - ".cargo/**"
+      - "rust-toolchain*"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.base.json"
+      - ".npmrc"
+      - "!**/*.md"
+      - "!scripts/*docs*"
+      - "!scripts/build-static-site.mjs"
+      - "!scripts/verify-static-site.mjs"
+      - "!scripts/e2e-site-install.mjs"
+      - "!scripts/verify-github-workflows.sh"
+      - "!scripts/verify-requirements.sh"
+      - "!scripts/setup-github-actions.mjs"
+      - "!scripts/test-setup-github-actions.mjs"
+  workflow_dispatch:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
+  changes:
+    name: Check affected inputs
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      run: ${{ steps.scope.outputs.run }}
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - id: scope
+        name: Check paths and dependency impact
+        run: ruby scripts/ci-impact.rb application .github/workflows/ci.yml
+
   validate:
     name: Validate workspace
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
+    concurrency:
+      group: ci-${{ github.ref }}
+      cancel-in-progress: true
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -59,43 +124,3 @@ jobs:
 
       - name: Run workspace checks
         run: pnpm check
-
-  validate-aur-source:
-    name: Build source AUR packages on Arch Linux
-    runs-on: ubuntu-latest
-    timeout-minutes: 90
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7.0.0
-        with:
-          fetch-depth: 0
-
-      - name: Build and inspect source package
-        env:
-          LOOPWIRE_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: |
-          set -euo pipefail
-          release_tag="$(git describe --tags --abbrev=0 --match 'v[0-9]*')"
-          export LOOPWIRE_AUR_VERSION="${release_tag#v}"
-          export LOOPWIRE_AUR_GIT_VERSION="$(
-            git describe --long --tags --abbrev=7 "origin/$LOOPWIRE_DEFAULT_BRANCH" |
-              sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
-          )"
-          docker run --rm \
-            --env LOOPWIRE_AUR_VERSION \
-            --env LOOPWIRE_AUR_GIT_VERSION \
-            --env LOOPWIRE_DEFAULT_BRANCH \
-            --volume "$GITHUB_WORKSPACE:/workspace:ro" \
-            archlinux@sha256:84cd9ef000b3cff245ec028e87965b84724f4bf1cc63fc2741ba927b88515ed6 \
-            bash -ceu '
-              pacman -Syu --noconfirm --needed \
-                curl git namcap nodejs pipewire pnpm rust webkit2gtk-4.1 wireplumber
-              useradd --create-home aur-builder
-              runuser -u aur-builder -- env HOME=/home/aur-builder \
-                bash /workspace/scripts/verify-aur-source-package.sh \
-                  --version "$LOOPWIRE_AUR_VERSION"
-              runuser -u aur-builder -- env HOME=/home/aur-builder \
-                bash /workspace/scripts/verify-aur-git-package.sh \
-                  --version "$LOOPWIRE_AUR_GIT_VERSION" \
-                  --default-branch "$LOOPWIRE_DEFAULT_BRANCH"
-            '

.github/workflows/deploy-docs.yml

@@ -8,6 +8,26 @@ on:
       - main
     tags:
       - "v*"
+    paths:
+      - ".github/workflows/deploy-docs.yml"
+      - "apps/site/**"
+      - "apps/docs/**"
+      - "assets/product-screenshot.png"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.base.json"
+      - ".npmrc"
+      - "scripts/install.sh"
+      - "scripts/build-static-site.mjs"
+      - "scripts/verify-static-site.mjs"
+      - "scripts/verify-docs.sh"
+      - "scripts/verify-support-matrix.mjs"
+      - "scripts/verify-vm-evidence.sh"
+      - "vm/targets.tsv"
+      - "scripts/deploy-docs-bunny.sh"
+      - "scripts/verify-docs-deployment-manifest.mjs"
+      - "scripts/verify-docs-live.sh"
 
 permissions:
   contents: read
@@ -60,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     environment: docs-production
-    if: >
+    if: >-
       ${{
         github.event_name == 'workflow_dispatch' ||
         github.ref == 'refs/heads/main' ||

.github/workflows/web.yml

@@ -0,0 +1,100 @@
+name: Web and Docs
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/web.yml"
+      - "apps/site/**"
+      - "apps/docs/**"
+      - "assets/product-screenshot.png"
+      - "README.md"
+      - "packaging/README.md"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.base.json"
+      - ".npmrc"
+      - "scripts/ci-impact.rb"
+      - "scripts/test-ci-impact.rb"
+      - "scripts/test-ci-workflow-paths.rb"
+      - "scripts/install.sh"
+      - "scripts/build-static-site.mjs"
+      - "scripts/verify-static-site.mjs"
+      - "scripts/e2e-site-install.mjs"
+      - "scripts/verify-docs.sh"
+      - "scripts/verify-support-matrix.mjs"
+      - "scripts/verify-vm-evidence.sh"
+      - "vm/targets.tsv"
+  push:
+    branches: [master, main]
+    paths:
+      - ".github/workflows/web.yml"
+      - "apps/site/**"
+      - "apps/docs/**"
+      - "assets/product-screenshot.png"
+      - "README.md"
+      - "packaging/README.md"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "tsconfig.base.json"
+      - ".npmrc"
+      - "scripts/ci-impact.rb"
+      - "scripts/test-ci-impact.rb"
+      - "scripts/test-ci-workflow-paths.rb"
+      - "scripts/install.sh"
+      - "scripts/build-static-site.mjs"
+      - "scripts/verify-static-site.mjs"
+      - "scripts/e2e-site-install.mjs"
+      - "scripts/verify-docs.sh"
+      - "scripts/verify-support-matrix.mjs"
+      - "scripts/verify-vm-evidence.sh"
+      - "vm/targets.tsv"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Check affected inputs
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      run: ${{ steps.scope.outputs.run }}
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - id: scope
+        name: Check paths and dependency impact
+        run: ruby scripts/ci-impact.rb web .github/workflows/web.yml
+
+  validate-web:
+    name: Validate website and docs
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
+    concurrency:
+      group: web-${{ github.ref }}
+      cancel-in-progress: true
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7.0.0
+      - uses: pnpm/action-setup@v6.0.9
+        with:
+          version: 11.3.0
+      - uses: actions/setup-node@v6.4.0
+        with:
+          node-version: 22.23.1
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Check website and docs types
+        run: pnpm --filter @loopwire/site --filter @loopwire/docs typecheck
+      - name: Check documentation contracts
+        run: pnpm verify:docs && pnpm verify:requirements
+      - name: Test documentation
+        run: pnpm --filter @loopwire/docs test
+      - name: Build and verify the static site
+        run: pnpm build:web && pnpm verify:site