Deterministic, scoped CI

CI jobs that build artifacts must be deterministic and guarded, and CI tests must be scoped to avoid unnecessary heavy work.

Apply these rules 1) Guard CI assumptions (fail loudly): If a build-time tweak is required (e.g., removing -march=native leakage), make the script error when the expected input/state isn’t found—never allow a “no-op” edit that silently produces a different binary. 2) Keep scripts portable and version-stable: Use portable tooling options (e.g., sed -i.bak) and pin dependency/build versions so pattern matches don’t break unexpectedly. 3) Avoid rebuilding heavyweight dependencies in-line: Prefer prebuilt images/artifacts, caching, or reusing a prior build. 4) Scope expensive tests by change set: Move costly jobs (like Docker image build + integration runs) into separate workflows/jobs and run them only when relevant files change.

Example: fail loudly + portable edit (bash)

set -euo pipefail
# ... obtain/extract source at a pinned version ...
file="CMakeLists.txt"
needle='add_compile_options(-march=native)'

# Portable in-place edit with backup, and verify the line existed.
if ! grep -qF "${needle}" "${file}"; then
  echo "Expected line not found: ${needle} (refusing to build native-leaking artifact)" >&2
  exit 1
fi
sed -i.bak "/${needle//\//\\\/}/d" "${file}"

Example: run expensive workflow only when relevant paths change (GitHub Actions)

on:
  push:
    paths:
      - 'ops.lua'
      - 'docker-entrypoint.sh'
      - 't/cli/test_standalone_docker.sh'
      - 'ci/**'

This standard prevents silent build drift and keeps pipelines fast by doing the minimum necessary work per change.