GRM-51: fix: release pipeline determinism with lock, rebase, and consistent classification

.gitea/workflows/ci.yml

@@ -68,24 +68,28 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Set up environment
+        run: make setup
       - name: Detect changed paths
         id: detect
+        env:
+          PYTHONPATH: src
         run: |
           set -euo pipefail
+          . .venv/bin/activate
           BASE="origin/master"
           HEAD="${{ github.event.pull_request.head.sha || github.sha }}"
-          # Check if any Ansible-related files changed
-          ANSIBLE_CHANGED=$(git diff --name-only "$BASE" "$HEAD" -- ansible/ .ansible-lint 2>/dev/null | head -1)
-          if [ -n "$ANSIBLE_CHANGED" ]; then
+          # Use classify_changes.py for consistent file classification
+          ANSIBLE_RESULT=$(python3 scripts/ci/classify_changes.py --base "$BASE" --head "$HEAD" --check ansible --quiet)
+          if [ "$ANSIBLE_RESULT" = "true" ]; then
             echo "ansible-changed=true" >> "$GITHUB_OUTPUT"
             echo "Ansible files changed — molecule tests will run."
           else
             echo "ansible-changed=false" >> "$GITHUB_OUTPUT"
             echo "No Ansible files changed — skipping molecule tests."
           fi
-          # Check if any user-facing files changed (src/, ansible/, pyproject.toml)
-          USER_FACING=$(git diff --name-only "$BASE" "$HEAD" -- src/gitea_runner_manager/ ansible/ pyproject.toml 2>/dev/null | head -1)
-          if [ -n "$USER_FACING" ]; then
+          USER_FACING_RESULT=$(python3 scripts/ci/classify_changes.py --base "$BASE" --head "$HEAD" --check user-facing --quiet)
+          if [ "$USER_FACING_RESULT" = "true" ]; then
             echo "user-facing-changed=true" >> "$GITHUB_OUTPUT"
             echo "User-facing files changed — release dry-run will run."
           else