Move the docs-only decision into ci.sh so it runs locally

src/ci-gate.test.ts

@@ -0,0 +1,34 @@
+// Guards the docs-only fast path: `ci.sh` no-ops when nothing but *.md changed since main. The
+// decision lives in ci.sh alone so `bash ci.sh` reproduces CI locally, and the workflow must still
+// push the commit-hash image when it no-ops — release.yml re-tags that exact image, and
+// fast-forward-only merges make every branch head a main commit.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+const read = (p: string) => readFileSync(new URL(`../${p}`, import.meta.url), "utf8");
+const workflow = read(".gitea/workflows/ci.yml");
+const gate = read("ci.sh");
+const step = (needle: string) => {
+	const found = workflow.split("\n      - ").slice(1).filter((s) => s.includes(needle));
+	assert.equal(found.length, 1, `exactly one workflow step contains ${needle}`);
+	return found[0]!;
+};
+
+test("the skip decision lives in ci.sh, so the workflow only runs it", () => {
+	assert.match(gate, /docs_only\(\)/);
+	assert.doesNotMatch(workflow, /docs_only|merge-base|GITHUB_OUTPUT/);
+});
+
+test("checkout is unshallow — the docs-only check needs the branch's history", () => {
+	assert.match(step("actions/checkout"), /fetch-depth: 0/);
+});
+
+test("the commit-hash image is pushed even when the gate no-ops", () => {
+	assert.doesNotMatch(step("docker push"), /^\s*if:/m);
+});
+
+test("only *.md counts as docs, and a dirty working tree counts as changed", () => {
+	assert.ok(gate.includes("\\.md$"), "the non-docs match is a *.md suffix test");
+	assert.match(gate, /git status --porcelain/, "uncommitted code can never be skipped over");
+});

src/ci-workflow.test.ts

@@ -1,32 +0,0 @@
-// Guards the docs-only fast path in .gitea/workflows/ci.yml: a branch that only touches *.md
-// skips `ci.sh`, but must still publish its commit-hash image — release.yml re-tags that exact
-// image, and fast-forward-only merges make every branch head a main commit.
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-
-const ci = readFileSync(new URL("../.gitea/workflows/ci.yml", import.meta.url), "utf8");
-const steps = ci.split("\n      - ").slice(1);
-const step = (needle: string) => {
-	const found = steps.filter((s) => s.includes(needle));
-	assert.equal(found.length, 1, `exactly one step contains ${needle}`);
-	return found[0]!;
-};
-
-test("checkout is unshallow — the merge-base with main needs the branch's history", () => {
-	assert.match(step("actions/checkout"), /fetch-depth: 0/);
-});
-
-test("a docs-only branch skips the test gate", () => {
-	assert.match(step("bash ci.sh"), /if: steps\.scope\.outputs\.docs_only != 'true'/);
-});
-
-test("a docs-only branch still pushes its commit-hash image", () => {
-	assert.doesNotMatch(step("docker push"), /^\s*if:/m);
-});
-
-test("only *.md counts as docs, and anything unexpected runs the gate", () => {
-	const detect = step("docs_only=");
-	assert.ok(detect.includes("\\.md$"), "the non-docs match is a *.md suffix test");
-	assert.ok(detect.includes("docs_only=false"), "the fallback is the full gate, never a skip");
-});