RC-CI-GUARD: scope immutable RC verification

.github/workflows/test.yml

@@ -28,12 +28,80 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Classify release candidate scope
+        id: rc-scope
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+          PUSH_HEAD_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+
+          fail() {
+            printf '::error::%s\n' "$*" >&2
+            exit 1
+          }
+
+          valid_sha() {
+            [[ "$1" =~ ^[0-9a-fA-F]{40}$ ]] &&
+              [[ "$1" != 0000000000000000000000000000000000000000 ]]
+          }
+
+          case "$EVENT_NAME" in
+            pull_request)
+              base_sha="$PR_BASE_SHA"
+              head_sha="$PR_HEAD_SHA"
+              ;;
+            push)
+              base_sha="$PUSH_BEFORE_SHA"
+              head_sha="$PUSH_HEAD_SHA"
+              ;;
+            *)
+              fail "Unsupported event for release-candidate scope classification: $EVENT_NAME"
+              ;;
+          esac
+
+          valid_sha "$base_sha" || fail "Invalid or missing base SHA"
+          valid_sha "$head_sha" || fail "Invalid or missing head SHA"
+          git cat-file -e "${base_sha}^{commit}" || fail "Base SHA is not an available commit"
+          git cat-file -e "${head_sha}^{commit}" || fail "Head SHA is not an available commit"
+
+          diff_file="$(mktemp)"
+          trap 'rm -f "$diff_file"' EXIT
+          if ! git diff --name-only -z --no-renames "$base_sha" "$head_sha" -- >"$diff_file"; then
+            fail "Unable to classify the exact base-to-head diff"
+          fi
+
+          required=false
+          while IFS= read -r -d '' path; do
+            if [[ "$path" == .github/workflows/test.yml ]]; then
+              required=true
+              continue
+            fi
+
+            if [[ "$path" == docs/releases/* ]]; then
+              receipt="${path#docs/releases/}"
+              if [[ "$receipt" != */* && "$receipt" == *.json ]]; then
+                required=true
+              fi
+            fi
+          done <"$diff_file"
+
+          [[ -n "${GITHUB_OUTPUT:-}" ]] || fail "GITHUB_OUTPUT is unavailable"
+          printf 'required=%s\n' "$required" >>"$GITHUB_OUTPUT"
       - uses: actions/setup-python@v6
         with:
           python-version: '3.11'
       - name: Build release candidate
+        if: steps.rc-scope.outputs.required == 'true'
         run: python -m pip install --upgrade pip build && rm -rf dist && python -m build --wheel
       - name: Verify release candidate bytes and package identity
+        if: steps.rc-scope.outputs.required == 'true'
         run: |
           python - <<'PY'
           import hashlib
@@ -62,6 +130,7 @@ jobs:
           assert identity == "sha256:" + hashlib.sha256(manifest_bytes).hexdigest()
           PY
       - uses: actions/upload-artifact@v6
+        if: steps.rc-scope.outputs.required == 'true'
         with:
           name: hermes-workflows-0.0.1rc1-${{ github.sha }}
           path: dist/hermes_workflows-0.0.1rc1-py3-none-any.whl