Initial commit

scripts/detect-ci-changes.sh

@@ -0,0 +1,83 @@
+#!/bin/sh
+set -eu
+
+set_output() {
+  key="$1"
+  value="$2"
+  if [ -n "${GITHUB_OUTPUT:-}" ]; then
+    printf '%s=%s\n' "$key" "$value" >> "$GITHUB_OUTPUT"
+  fi
+  printf '%s=%s\n' "$key" "$value"
+}
+
+set_all() {
+  value="$1"
+  set_output app "$value"
+  set_output security_deps "$value"
+  set_output deploy "$value"
+}
+
+event_name="${GITHUB_EVENT_NAME:-}"
+if [ "$event_name" = "schedule" ] || [ "$event_name" = "workflow_dispatch" ]; then
+  echo "Running all jobs for $event_name."
+  set_all true
+  exit 0
+fi
+
+head_sha="${GITHUB_SHA:-HEAD}"
+base_sha="${CHANGESET_PR_BASE_SHA:-}"
+before_sha="${CHANGESET_BEFORE:-}"
+zero_sha="0000000000000000000000000000000000000000"
+
+if [ -z "$base_sha" ] && [ -n "$before_sha" ] && [ "$before_sha" != "$zero_sha" ]; then
+  base_sha="$before_sha"
+fi
+
+if [ -z "$base_sha" ]; then
+  echo "No reliable base commit found; running all jobs."
+  set_all true
+  exit 0
+fi
+
+if ! git cat-file -e "$base_sha^{commit}" 2>/dev/null; then
+  git fetch --no-tags --depth=1 origin "$base_sha" || true
+fi
+
+if ! git cat-file -e "$base_sha^{commit}" 2>/dev/null; then
+  echo "Base commit $base_sha is unavailable; running all jobs."
+  set_all true
+  exit 0
+fi
+
+changed_files="$(git diff --name-only "$base_sha" "$head_sha")"
+if [ -z "$changed_files" ]; then
+  echo "No changed files detected."
+  set_all false
+  exit 0
+fi
+
+app=false
+security_deps=false
+deploy=false
+
+echo "Changed files:"
+printf '%s\n' "$changed_files"
+
+for path in $changed_files; do
+  case "$path" in
+    *)
+      app=true
+      deploy=true
+      ;;
+  esac
+
+  case "$path" in
+    .gitea/workflows/*|docker-compose*.yml|scripts/trivy-scan.sh|Dockerfile*|package.json|package-lock.json)
+      security_deps=true
+      ;;
+  esac
+done
+
+set_output app "$app"
+set_output security_deps "$security_deps"
+set_output deploy "$deploy"