[bpamiri]

Summary

peter-evans/create-pull-request stages every change in the working tree by default. The RustCFML version check runs the full suite before opening its bump PR. So its first real bump PR, #4577, also committed the run's public/logs/*.log (8 files, ~5.8k lines) and tools/ci/__pycache__/*.pyc. Those were removed from #4577 by hand; this PR stops it happening again.

• rustcfml-version-check.yml: add-paths is limited to the four files bump-pin.sh and run-suite.sh --write-baseline write:
  • tools/rustcfml/ENGINE_VERSION
  • tools/rustcfml/ENGINE_SHA256
  • tools/rustcfml/baseline.json
  • cli/lucli/services/rustcfml/RustCFMLEngine.cfc
• bump-develop-version.yml: add-paths: wheels.json. Not strictly needed: nothing else in that job writes to the tree, and its past PRs (chore: bump develop snapshot target to 4.2.1 #4555, chore: bump develop snapshot target to 4.1.3 #3879, chore: bump develop snapshot target to 4.1.2 #3765) contain only wheels.json. It keeps the two bump steps consistent and guards against future steps writing files.
• .gitignore: adds public/logs/ and __pycache__/. Neither is tracked today.
• CI on bot PRs: both steps now say in a comment that a PR opened with GITHUB_TOKEN starts no workflows. Whoever handles the bump PR pushes a commit (an empty one is fine) to start CI. This is the existing practice for the develop bump; no token change.

Verification

• actionlint is clean on rustcfml-version-check.yml. bump-develop-version.yml has only the 2 SC2086 notes already on develop.
• git check-ignore matches public/logs/wheels.log and tools/ci/__pycache__/*.pyc.
• The full path is exercised by the next RustCFML release's version-check run (or the next GA release for the develop bump).

Refs #4577

🤖 Generated with Claude Code

[bpamiri]

rev1-r3 review @ e6b16bc: APPROVE

1. add-paths covers everything the bumps write.

• The RustCFML check's green path is pin() → bump-pin.sh <tag>, then run-suite.sh --write-baseline:

  • bump-pin.sh writes tools/rustcfml/ENGINE_VERSION (echo "$TAG" >) and tools/rustcfml/ENGINE_SHA256 (printf … >), and edits cli/lucli/services/rustcfml/RustCFMLEngine.cfc with sed -i.bak for the tag and per-asset SHAs. It then removes the .bak.
  • --write-baseline writes only tools/rustcfml/baseline.json.
  • The run's verdict JSON goes to RUSTCFML_RESULT_JSON under RUNNER_TEMP, outside the repo.

  Those are exactly the four listed paths, so nothing a bump produces is dropped, and the logs and caches the suite leaves in the tree are no longer staged.

• bump-develop-version.yml writes only wheels.json (the jq … > wheels.json.tmp && mv step), which is its add-paths.

2. The .gitignore entries hide nothing tracked. git ls-tree -r at this head has no tracked path under any public/logs/ or any __pycache__/ directory, at any depth. Both patterns are unanchored, so they also cover nested copies; none exist.

3. Comments. The "a PR opened with GITHUB_TOKEN doesn't trigger workflows; push a commit to its branch to start CI" note is accurate for both steps, which use the default token.

actionlint: rustcfml-version-check.yml is clean. bump-develop-version.yml reports only two SC2086 info notes in an unrelated run: script; develop has the same two.

PR CI: 12 pass, 3 skipping, 0 fail. Up to date with develop, MERGEABLE.