From 7fcdacee26e6f072b024af4fb8eff9edb68e1459 Mon Sep 17 00:00:00 2001
From: Boris Tyshkevich <btyshkevich@altinity.com>
Date: Mon, 26 Oct 2026 16:02:00 +0100
Subject: [PATCH] ci: run deploy-integration only for installer changes

The ~5 min/image Docker cluster job ran on every push to main and on PRs
touching anything under deploy/** (Caddy, Helm, k8s), package.json
(every dependency bump), any workflow, or the unit-level installer tests.
Narrow the PR filter to the shipped installer files (install.sh,
uninstall.sh, lib/, http_handlers.xml), tests/deploy/, and ci.yml, and
drop the push-to-main trigger (release tags and manual dispatch still
run it; images are pinned, so an unchanged installer cannot drift).
Unit-level installer tests stay in the `test` job.

Refs #692

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P3CopPwrpzeWAJd7vaaLSk
---
 .github/workflows/ci.yml         | 20 +++++++++++++-------
 .wiki/Deployment-and-Security.md |  5 ++++-
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 086a9b00..540f2971 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -100,14 +100,17 @@ jobs:
               - '.github/workflows/**'
               - 'packages/**'
             # #692: the installer integration test (real Keeper + 2x2 ClickHouse
-            # cluster in Docker). The installer, its tests, and the workflow.
+            # cluster in Docker, ~5 min per image). Deliberately narrow: only the
+            # shipped installer files, the harness, and this workflow. SPA
+            # source, deps (package.json), Caddy/Helm/k8s, and the unit-level
+            # installer tests (covered by the `test` job) do not trigger it.
             deploy:
-              - 'deploy/**'
+              - 'deploy/install.sh'
+              - 'deploy/uninstall.sh'
+              - 'deploy/lib/**'
+              - 'deploy/http_handlers.xml'
               - 'tests/deploy/**'
-              - 'tests/helpers/deploy-*'
-              - 'tests/unit/*-script.test.js'
-              - 'package.json'
-              - '.github/workflows/**'
+              - '.github/workflows/ci.yml'
             docker:
               - 'Dockerfile'
               - 'deploy/caddy/**'
@@ -427,11 +430,14 @@ jobs:
   # /sql and /sql/config.json serve after install, upgrade, repair, partial
   # failure, and uninstall. Matrix over the supported server flavours; pin exact
   # tags so a moving image cannot turn this red unrelated to the diff.
+  # Runs only on PRs touching the installer (see the `deploy` filter), release
+  # tags, and manual dispatch — not on every push to main, and not nightly:
+  # the images are pinned, so an unchanged installer cannot drift.
   deploy-integration:
     needs: changes
     if: >-
-      github.event_name == 'push' ||
       github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
       (github.event_name == 'pull_request' && needs.changes.outputs.deploy == 'true')
     runs-on: ubuntu-latest
     timeout-minutes: 30
diff --git a/.wiki/Deployment-and-Security.md b/.wiki/Deployment-and-Security.md
index 02b4e6e6..b0d04a27 100644
--- a/.wiki/Deployment-and-Security.md
+++ b/.wiki/Deployment-and-Security.md
@@ -16,7 +16,10 @@ the target of a remote-source statement). Needs a cluster `<secret>` and the
 documented minimal grants. `npm run test:deploy` (`tests/deploy/`, CI job
 `deploy-integration`) runs it against Keeper + 2x2 ClickHouse on exact tags
 (26.3.18.32, Antalya 25.8.33) and asserts byte-exact files on every node,
-including a node killed mid-run. The release bundle ships `deploy/` (install.sh,
+including a node killed mid-run. The job runs only on PRs that touch the
+installer files (`deploy/install.sh`, `uninstall.sh`, `lib/`,
+`http_handlers.xml`), `tests/deploy/`, or `ci.yml`, plus release tags and
+manual dispatch — never for SPA-only changes or on every push to `main`. The release bundle ships `deploy/` (install.sh,
 uninstall.sh, lib/) for use with `--artifact`. One installer at a time (no lock);
 `--ddl-timeout` must be >= 1; the password reaches only `clickhouse-client`.