From 7a366a93c86853defa65cc0f9a1411be4ca40a00 Mon Sep 17 00:00:00 2001
From: aoirint <aoirint@gmail.com>
Date: Wed, 28 Oct 2026 09:41:28 +0900
Subject: [PATCH] fix(ci): restore normal image publishing on main

Restore the original main-push image publishing path; preserve the APM deployment.

Co-authored-by: Codex <noreply@openai.com>
---
 .github/scripts/application-change-scope.sh | 56 ---------------------
 .github/workflows/main.yml                  | 11 ----
 AGENTS.md                                   |  7 ---
 3 files changed, 74 deletions(-)
 delete mode 100644 .github/scripts/application-change-scope.sh

diff --git a/.github/scripts/application-change-scope.sh b/.github/scripts/application-change-scope.sh
deleted file mode 100644
index 4b7f20e..0000000
--- a/.github/scripts/application-change-scope.sh
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-# Keep APM-only maintenance on the validation path, without image publishing.
-set -euo pipefail
-
-[[ "${BEFORE_SHA:-}" =~ ^[0-9a-f]{40}$ ]] || exit 1
-[[ "${AFTER_SHA:-}" =~ ^[0-9a-f]{40}$ ]] || exit 1
-git cat-file -e "${BEFORE_SHA}^{commit}"
-git cat-file -e "${AFTER_SHA}^{commit}"
-
-changed_paths="$(mktemp)"
-workflow_diff="$(mktemp)"
-trap 'rm -f -- "$changed_paths" "$workflow_diff"' EXIT
-git diff --no-renames --name-only -z "$BEFORE_SHA" "$AFTER_SHA" > "$changed_paths"
-
-# A workflow can hold application inputs (for example image variants). Ignore
-# only additions made by this scope gate; all other workflow edits still publish.
-workflow_adds_only_scope_gate() {
-  git diff --no-ext-diff --unified=0 "$BEFORE_SHA" "$AFTER_SHA" -- \
-    .github/workflows/main.yml > "$workflow_diff" || return 1
-  while IFS= read -r line; do
-    case "$line" in
-      'diff --git '*|'index '*|'--- '*|'+++ '*|'@@ '*) ;;
-      -*) return 1 ;;
-      +*)
-        case "${line:1}" in
-          ''|"      publish_application: \${{ steps.scope.outputs.publish_application }}"|\
-          '          fetch-depth: 0'|'      - name: Classify application changes'|\
-          '        id: scope'|'        env:'|\
-          "          BEFORE_SHA: \${{ github.event.before }}"|\
-          "          AFTER_SHA: \${{ github.sha }}"|\
-          '        run: bash .github/scripts/application-change-scope.sh'|\
-          '    # APM maintenance still runs Check; image publishing needs application changes.'|\
-          "    if: needs.plan.outputs.publish_application == 'true'") ;;
-          *) return 1 ;;
-        esac
-        ;;
-      *) return 1 ;;
-    esac
-  done < "$workflow_diff"
-}
-
-publish_application=false
-while IFS= read -r -d '' path; do
-  case "$path" in
-    .agents/skills/*|apm.yml|apm.lock.yaml|AGENTS.md|THIRD_PARTY_NOTICES.md|\
-    .github/actions/check-docker-source/action.yml|\
-    .github/scripts/application-change-scope.sh|docs/operations/publish-images.md)
-      ;;
-    .github/workflows/main.yml)
-      workflow_adds_only_scope_gate || publish_application=true
-      ;;
-    *) publish_application=true ;;
-  esac
-done < "$changed_paths"
-
-printf 'publish_application=%s\n' "$publish_application" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9d90677..7e42a37 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -32,22 +32,13 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 5
     outputs:
-      publish_application: ${{ steps.scope.outputs.publish_application }}
       release_mode: ${{ steps.version.outputs.release_mode }}
       tag: ${{ steps.version.outputs.tag }}
     steps:
       - name: Checkout integrated source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0
           persist-credentials: false
-      - name: Classify application changes
-        id: scope
-        env:
-          BEFORE_SHA: ${{ github.event.before }}
-          AFTER_SHA: ${{ github.sha }}
-        run: bash .github/scripts/application-change-scope.sh
-
       - name: Read release version
         id: version
         run: |-
@@ -68,8 +59,6 @@ jobs:
           echo "release_mode=${release_mode}" >> "$GITHUB_OUTPUT"
 
   build:
-    # APM maintenance still runs Check; image publishing needs application changes.
-    if: needs.plan.outputs.publish_application == 'true'
     needs: [check, plan]
     runs-on: ubuntu-24.04
     permissions:
diff --git a/AGENTS.md b/AGENTS.md
index 0e7bd8a..c3bc260 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -37,10 +37,3 @@ A maintainer may explicitly waive the normal seven-day wait for the latest
 `aoirint/skills` main commit. Record the waiver and exact full commit SHA in
 the pull request. That waiver applies only to the `aoirint/skills` commit; it
 does not waive review or cooldown requirements for any of its dependencies.
-
-## APM-only maintenance in CI
-
-Main retains source checks for APM-only pin, ledger, generated Skill, guide,
-and validation-CI changes, while skipping image build and publication. Other
-application or workflow-input changes retain the publishing path. An unavailable
-push comparison fails closed instead of publishing an unclassified change.