From d0d63640e7bd06f17f3ffb27ec49a9d163a73710 Mon Sep 17 00:00:00 2001
From: kanywst <niwatakuma@icloud.com>
Date: Sat, 2 May 2026 16:13:32 +0900
Subject: [PATCH 1/2] ci(test): pin Go via go.mod and skip demo-only commits

Replaces the hard-coded '1.25.6' Go version with go-version-file: go.mod
so the workflow always matches the module's required toolchain. The
previous setup worked under setup-go@v5 because GOTOOLCHAIN defaulted
to auto and the toolchain was downloaded transparently; setup-go@v6
sets GOTOOLCHAIN=local, which exposed the drift the moment dependabot
tried the bump.

Adds paths-ignore for demo.gif and README.md so the upcoming demo
regen workflow's auto-commits don't trigger a redundant test run.
---
 .github/workflows/test.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 69be184..3622b73 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -3,6 +3,9 @@ name: Test
 on:
   push:
     branches: [ main ]
+    paths-ignore:
+      - 'demo.gif'
+      - 'README.md'
   pull_request:
     branches: [ main ]
 
@@ -16,7 +19,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.25.6'
+        go-version-file: go.mod
 
     - name: Download dependencies
       run: go mod download

From 9cea701485324fd8cabff6d8947a3f6e3fb58eda Mon Sep 17 00:00:00 2001
From: kanywst <niwatakuma@icloud.com>
Date: Sat, 2 May 2026 16:13:51 +0900
Subject: [PATCH 2/2] ci: regenerate demo.gif on main pushes that touch the UI

Triggers on changes to demo.tape, cmd, internal, pkg, or
gen_demo_certs.go. Uses charmbracelet/vhs-action to render demo.tape
and commits the result back when it differs. Pushes through the default
GITHUB_TOKEN, which by GitHub design does NOT trigger downstream
workflows, so this can't loop on its own commit; the test workflow
also paths-ignores demo.gif as belt-and-suspenders.

Only demo.gif is committed; testdata/demo/certs.pem is regenerated
inside the tape's Hide block but stays out of the auto-commit because
gen_demo_certs is non-deterministic and would churn every run.
---
 .github/workflows/demo.yml | 47 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .github/workflows/demo.yml

diff --git a/.github/workflows/demo.yml b/.github/workflows/demo.yml
new file mode 100644
index 0000000..06de4a8
--- /dev/null
+++ b/.github/workflows/demo.yml
@@ -0,0 +1,47 @@
+name: Demo
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'demo.tape'
+      - 'cmd/**'
+      - 'internal/**'
+      - 'pkg/**'
+      - 'scripts/gen_demo_certs.go'
+      - '.github/workflows/demo.yml'
+
+permissions:
+  contents: write
+
+concurrency:
+  group: demo-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  render:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Render demo.gif
+        uses: charmbracelet/vhs-action@v2
+        with:
+          path: demo.tape
+
+      - name: Commit and push if demo.gif changed
+        run: |
+          if git diff --quiet -- demo.gif; then
+            echo "demo.gif unchanged, nothing to commit"
+            exit 0
+          fi
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add demo.gif
+          git commit -m "chore(demo): refresh demo.gif"
+          git push