fix: harden ci and sync workflow

Author: CodeSigils

.github/workflows/ci.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - ".github/workflows/ci.yml"
       - ".github/scripts/**"
+      - ".gitignore"
       - "README.md"
       - "CITATION.cff"
       - "SECURITY.md"
@@ -17,6 +18,7 @@ on:
     paths:
       - ".github/workflows/ci.yml"
       - ".github/scripts/**"
+      - ".gitignore"
       - "README.md"
       - "CITATION.cff"
       - "SECURITY.md"

scripts/sync-payload.sh

@@ -7,6 +7,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 MANIFEST="$ROOT/scripts/payload-manifest.json"
 PAYLOAD_DIR="$ROOT/skills/python-project-workflow"
 CI_MODE=false
+declare -a MANIFEST_FILES MANIFEST_SCRIPTS
 
 [ "${1:-}" = "--ci" ] && CI_MODE=true
 
@@ -17,6 +18,40 @@ DRIFT=false
 CHANGED=false
 SYNC_ERROR=false
 
+manifest_entries() {
+    local key="$1"
+
+    python3 - "$MANIFEST" "$key" <<'PY'
+import json
+import sys
+
+path, key = sys.argv[1], sys.argv[2]
+with open(path, encoding="utf-8") as fh:
+    data = json.load(fh)
+for item in data.get(key, []):
+    sys.stdout.write(f"{item}\0")
+PY
+}
+
+manifest_scalar() {
+    local key="$1"
+
+    python3 - "$MANIFEST" "$key" <<'PY'
+import json
+import sys
+
+path, key = sys.argv[1], sys.argv[2]
+with open(path, encoding="utf-8") as fh:
+    data = json.load(fh)
+value = data.get(key, "")
+sys.stdout.write(value if isinstance(value, str) else "")
+PY
+}
+
+mapfile -d '' -t MANIFEST_FILES < <(manifest_entries files)
+mapfile -d '' -t MANIFEST_SCRIPTS < <(manifest_entries scripts)
+REF_MODE="$(manifest_scalar references)"
+
 mode_matches() {
     local target="$1"
     local mode="$2"
@@ -62,15 +97,13 @@ is_covered() {
     case "$rel" in
         SKILL.md) return 0 ;;
     esac
-    for f in $(python3 -c "import json; d=json.load(open('$MANIFEST')); print('\n'.join(str(x) for x in d.get('files',[])))" 2>/dev/null); do
+    for f in "${MANIFEST_FILES[@]}"; do
         [ "$rel" = "$f" ] && return 0
     done
-    for s in $(python3 -c "import json; d=json.load(open('$MANIFEST')); print('\n'.join(str(x) for x in d.get('scripts',[])))" 2>/dev/null); do
+    for s in "${MANIFEST_SCRIPTS[@]}"; do
         [ "$rel" = "scripts/$s" ] && return 0
     done
-    local ref_mode
-    ref_mode=$(python3 -c "import json; d=json.load(open('$MANIFEST')); r=d.get('references',''); print(r if isinstance(r,str) else '')" 2>/dev/null)
-    if [ "$ref_mode" = "*" ]; then
+    if [ "$REF_MODE" = "*" ]; then
         case "$rel" in
             references/*) [ -f "$ROOT/$rel" ] && return 0 ;;
         esac
@@ -79,14 +112,14 @@ is_covered() {
 }
 
 # Files
-for f in $(python3 -c "import json; d=json.load(open('$MANIFEST')); print('\n'.join(str(x) for x in d.get('files',[])))" 2>/dev/null); do
+for f in "${MANIFEST_FILES[@]}"; do
     source="$ROOT/$f"
     target="$PAYLOAD_DIR/$f"
     sync_file "$source" "$target" "$f"
 done
 
 # Scripts
-for s in $(python3 -c "import json; d=json.load(open('$MANIFEST')); print('\n'.join(str(x) for x in d.get('scripts',[])))" 2>/dev/null); do
+for s in "${MANIFEST_SCRIPTS[@]}"; do
     source="$ROOT/scripts/$s"
     target="$PAYLOAD_DIR/scripts/$s"
     mode=644
@@ -95,8 +128,7 @@ for s in $(python3 -c "import json; d=json.load(open('$MANIFEST')); print('\n'.j
 done
 
 # References (mirror)
-ref_mode=$(python3 -c "import json; d=json.load(open('$MANIFEST')); r=d.get('references',''); print(r if isinstance(r,str) else '')" 2>/dev/null)
-if [ "$ref_mode" = "*" ]; then
+if [ "$REF_MODE" = "*" ]; then
     for source in "$ROOT/references/"*.md; do
         if [ ! -f "$source" ]; then
             echo "  MISSING source: references/*.md"

scripts/validate-ci.py

@@ -29,6 +29,8 @@ def main() -> int:
     if validate is None:
         errors.append("ci.yml: missing validate job")
     else:
+        if '".gitignore"' not in workflow:
+            errors.append("ci.yml: validation workflow must trigger on .gitignore changes")
         if "python3 scripts/verify-urls.py" in validate:
             errors.append(
                 "ci.yml: live URL checks must not run in the validation matrix"