---
quick_id: 260613-fp9
title: ".gitea and .planning pushes should not trigger a docker image publish"
status: complete
date: 2026-06-13
---

# Quick Task 260613-fp9 — Summary

## What changed

Added a `paths-ignore` filter to the `push` trigger in
`.gitea/workflows/publish.yml`:

```yaml
on:
  push:
    branches: [main]
    paths-ignore:
      - '.gitea/**'
      - '.planning/**'
```

Updated the file's header comment to document the new skip behavior.

## Why

Every push to `main` previously ran a full Docker build + push. Pushes confined
to `.planning/**` (planning docs push straight to main under the unprotected
`.planning/*` branch-protection pattern) or `.gitea/**` (CI/workflow edits) never
change the shipped image — `.dockerignore` already excludes `.planning`. The
rebuild and `:latest` re-push were wasted runner time.

## Behavior

- Push touching only `.gitea/**` and/or `.planning/**` → `publish` job skipped.
- Push touching code / Dockerfile / manifests (alone or mixed with docs) →
  `publish` runs as before. `paths-ignore` skips only when **every** changed
  file matches a glob.

## Verification

- `python3 yaml.safe_load` parses the file; `on.push` carries both
  `branches: [main]` and `paths-ignore: ['.gitea/**', '.planning/**']`; the
  `publish` job is intact.
- The in-workflow `grep "--target production"` self-assertion still matches
  (D-10 hygiene check unaffected).

## Isolation note

Executed in a dedicated worktree (`familysync-wt-fp9`, branch
`quick/260613-fp9-publish-paths-ignore` off `origin/main`) because a concurrent
phase-10 agent has the main working tree checked out on
`gsd/phase-10-admin-role-settings`. No subagents spawned — trivial single-file
config edit done inline.

## Follow-up

`publish.yml` lives under `.gitea/**`, so merging this change will itself be a
`.gitea`-only push and will (correctly) not publish. Open a PR to `main`
(protected; code changes require PR).