GRM-37: feat: Smart CI and release skipping for workflow-only changes

AGENTS.md

@@ -125,19 +125,53 @@ After a PR is merged to master, the release pipeline runs automatically:
 1. **Release workflow** (`.gitea/workflows/release.yml`):
    - Triggers on push to master
    - Sets up full dev environment (`make setup`) so lint and tests can run
-   - Runs `scripts/release.py` which uses **git-cliff** to:
-     - Calculate the next semver version from conventional commits since the last tag
-     - Update `__version__` in `src/gitea_runner_manager/__init__.py` (single source of truth)
-     - Update `CHANGELOG.md` with the new version section
-     - **Run `make lint-ruff` and `make pytest-cov`** to verify the release is healthy
-     - If lint or tests fail, **abort immediately** — no commit, no tag
-     - Commit with `release: vX.Y.Z` prefix (cleaner than `chore(release):`)
-     - Create an annotated tag `vX.Y.Z` on the release commit
-     - Push both the commit and tag to master
+   - Runs `scripts/release.py` which:
+     - **Checks for user-facing changes** via `scripts/classify_changes.py` — if only
+       workflow/infrastructure files changed (`.gitea/`, `scripts/`, `docs/`, `tests/`,
+       `AGENTS.md`, `Makefile`, etc.), the release is **skipped entirely** — no version
+       bump, no tag, no publish. This prevents unnecessary releases for CI/docs-only changes.
+     - Uses **git-cliff** to calculate the next semver version from conventional commits
+     - Updates `__version__` in `src/gitea_runner_manager/__init__.py` (single source of truth)
+     - Updates `CHANGELOG.md` with the new version section
+     - **Runs `make lint-ruff` and `make pytest-cov`** to verify the release is healthy
+     - If lint or tests fail, **aborts immediately** — no commit, no tag
+     - Commits with `release: vX.Y.Z` prefix (cleaner than `chore(release):`)
+     - Creates an annotated tag `vX.Y.Z` on the release commit
+     - Pushes both the commit and tag to master
    - `--skip-tests` flag bypasses test verification (emergency use only, not recommended)
    - Loops are prevented by `has_unreleased_changes` — after a release commit is tagged, the next run finds no unreleased changes and exits
    - On failure, creates a Gitea issue via `scripts/notify_failure.py`
 
+### Smart CI: User-Facing vs Workflow-Only Changes
+
+Not all changes require the full CI pipeline or a new release. The project
+classifies changes into two categories:
+
+**User-facing paths** (tool changes → release needed):
+- `src/gitea_runner_manager/**` — Python CLI source
+- `ansible/**` — Ansible role
+- `pyproject.toml` — Package metadata
+
+**Workflow-only paths** (infrastructure → no release needed):
+- `.gitea/workflows/**` — Gitea Actions workflows
+- `scripts/**` — CI/CD automation scripts
+- `docs/**` — Documentation
+- `tests/**` — Test files
+- `AGENTS.md`, `README.md`, `CHANGELOG.md` — Project docs
+- `Makefile`, `cliff.toml`, `.pre-commit-config.yaml`, `.ansible-lint` — Config
+- `hooks/**` — Git hooks
+
+**CI behavior based on classification:**
+- **Molecule tests**: Only run when `ansible/` or `.ansible-lint` files change
+- **Release dry-run**: Only runs when user-facing files change
+- **Quality job** (lint, unit tests, coverage, doc-coverage): Always runs
+- **Release workflow**: Skips entirely when no user-facing files changed since last tag
+
+**AI agents must follow these rules:**
+- When working on workflow/CI/docs-only changes, use `ci:` or `docs:` commit prefixes
+- Do NOT bump the version or create tags for workflow-only changes
+- The `classify_changes.py` script enforces this automatically — no manual intervention needed
+
 2. **Publish workflow** (`.gitea/workflows/publish.yml`):
    - Triggers on tag push (`v*`)
    - Validates `PYPI_TOKEN` is set (warns if missing)