fix(ci): no release for merges that cannot reach a consumer (fixes #3023)

[mfal]

Relevance was decided by repo-root paths, so everything under packages/** counted as publish-relevant wholesale. Two of the empty-changelog releases in #3023 came from that, and one class the issue does not list came later.

What no longer publishes

Per PUSH, since that is what the decide job classifies:

Push	What it carried	Version it cut
#3010	only packages/components/.storybook/preview.tsx	1.0.14 — would not be cut now
#3008	the Storybook image's Dockerfile / .dockerignore	folded into 1.0.15, which also carried #3013 (a real change) and would still be cut

Two cases from #3023's evidence table are not closed, and that is deliberate — see "Not in scope":

Push	Why it still publishes
#3006 (cut 1.0.12)	its package.json scripts diff and src/tests/visual/** drop out, but remote-react-components/CONTRIBUTE.md and dev/cross-version/crossVersionRunner.ts stay relevant
#3020 (cut 1.1.5)	patches/ for @mfalkenberg/react-live-ssr, a dependency only apps/docs imports

The change

The criterion is consumer effect, not tarball membership. The two differ in both directions, and only the first decides: a tarball carries the package's scripts, yet nothing but the install lifecycle runs on a consumer's machine.

• Package-local denylist: .storybook/**, the Storybook image's Dockerfile/.dockerignore, e2e/**, src/tests/**, *.stories.*, *.test.*.
• Every package.json is judged by its key diff, not only the root one. scripts is irrelevant unless the diff touches preinstall, install, postinstall or prepare. No Flow package defines one today — which is exactly why the guard belongs in code and not in someone's memory. The decide job now fetches before/after for every changed manifest.
• packages/*/dev/** stays relevant, although Patch releases with an empty changelog: relevance is path-based, the changelog is type-based #3023 proposed skipping it. It is a build input: components/dev/vite/* is imported by vite.build.config.ts and shapes the emitted CSS layers, dev/component-index and dev/status-registry write shipped dist/assets/*.json, and codemods/dev/generate writes the published MIGRATION.md.
• A stories/ directory stays relevant too — only the story files are skipped. createDocPropertiesJson.ts parses every .tsx under src/ and ignores only *.stories.tsx, so components/Button/stories/lib.tsx contributes five entries to the published doc-properties.json.
• One gap stays open by choice: a patches/ entry for a dependency only a private project imports (1.1.5). Ruling it out needs the lockfile's importer graph including transitive edges, where a wrong answer swallows a real release. A test pins the current behaviour so the gap stays deliberate.

Tests and stories leave dist/types. unplugin-dts emitted declarations for all of src:

1.1.10	tarball entries	of those stories/tests
flow-react-components	4160	126 *.stories.d.ts + 126 maps
flow-remote-react-components	799	196 under dist/types/tests/**

All eight release builds now share publishedDtsOptions from packages/core. No consumer loses a type: no package's exports has a wildcard subpath, so those declarations were unreachable. The globs cannot move into the shared tsconfig preset instead — its exclude governs tsc --noEmit, and that would stop type-checking the tests.

@mittwald/flow-core is now a declared devDependency of ext-bridge, remote-core and remote-elements, which newly import it. That is also the nx graph edge their build cache needs in order to invalidate on a core change.

Verification

• Replayed every non-release commit on main since ci: skip the release for docs- and CI-only merges #2933 through the changed classifier: build(components): use the next-themes client entry in Storybook #3010 and ci: build the preview apps in CI and let the image only package them #3008 flip to no-publish, and no commit that produced a legitimate release flips with them.
• next is symmetric — docs-only chore(sync): merges produce no -next.N bump (docs: add Documentation section to CONTRIBUTE.md #3067, docs: split Upgrades off the Versionierung page #3064, docs(Modal): remove the confusing "Show CloseButton" section #3056, fix(docs): stop repeating the version as the release headline #3054 among others).
• 28 classifier tests, build and test:compile green for all eight touched packages; after the build, story/test declarations in dist/types drop from 252+6 to 18 in components and from 196 to 2 in remote-react-components. The remainder are real source modules the doc-properties generator sees, matching the denylist exactly.
• The decide job's shell loop was exercised locally against the no-match case (set -euo pipefail plus grep || true).

Not in scope

Tracked in #3083:

• The type-based half of Patch releases with an empty changelog: relevance is path-based, the changelog is type-based #3023 — real releases whose changelog reads "Version bump only", because relevance is path-based while the changelog is type-based. Since Patch releases with an empty changelog: relevance is path-based, the changelog is type-based #3023 was filed, 1.1.5, 1.1.7, 1.1.8 and 1.1.11 joined that list. Needs a changelogPreset decision, and an explanation for why 1.1.6 appears in the components changelog while 1.1.1 does not.
• The relevance residue — package-local non-shipped Markdown (judged against that package's files) and the test-only subdirectories of dev/. Those two are why ci: shard the visual and cross-version suites, and gate PRs on the iframe harness #3006 and test: add contribute info and explicit set visual light theme #3003 still publish.

Fixes #3023.

🤖 Generated with Claude Code

[github-actions]

Coverage Report for ./packages/components/

Status	Category	Percentage	Covered / Total
🔵	Lines	78.69%	746 / 948
🔵	Statements	78.57%	763 / 971
🔵	Functions	80.09%	165 / 206
🔵	Branches	70.33%	377 / 536

File Coverage

No changed files found.

Generated in workflow #6573 for commit 1145994 by the Vitest Coverage Report Action

[github-actions]

🚀 Preview Deployment

Preview environments are ready:

Type	URL
docs	pr-3081.docs.review.flow-components.de
storybook	pr-3081.storybook.review.flow-components.de

Images:

• docs: ghcr.io/mittwald/flow/docs:pr-3081
• storybook: ghcr.io/mittwald/flow/storybook:pr-3081

[mfal]

Superseded by #3098 and closing.

#3080 had already taken the same ground further: it carries the package-local denylist including CONTRIBUTE.md, dev/cross-version/** and dev/vitest/** (which I had deferred to #3083), returns the rule that decided each skip, and fixes the changelog half through changelogPreset. It also sits on newer main.

Nothing is lost: #3098 contains #3080's commit and carries over the one thing this branch had that it lacked — the publishedDtsOptions cleanup that keeps story and test declarations out of dist/types — plus the lockfile correction from this branch's second commit.

🤖 Closed by Claude Code