From 1a90e9768d82af81af1c24a648b9741565dbffc7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 15 May 2026 14:11:58 +0000
Subject: [PATCH 1/3] Initial plan


From d48f1caedd5eae69ec8a3a51d32a5242db40f219 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 15 May 2026 14:15:42 +0000
Subject: [PATCH 2/3] Add cross-stack publish skip gating to CI workflows

Agent-Logs-Url: https://github.com/envoyproxy/toolshed/sessions/289ef771-49e0-4434-9031-ab70cfee9088

Co-authored-by: phlax <454682+phlax@users.noreply.github.com>
---
 .github/workflows/actions.yml | 23 +++++++++++++++++++++++
 .github/workflows/bazel.yml   | 26 ++++++++++++++++++++++++++
 .github/workflows/docker.yml  | 23 +++++++++++++++++++++++
 .github/workflows/py.yml      | 26 ++++++++++++++++++++++++++
 .github/workflows/rust.yml    | 24 ++++++++++++++++++++++++
 5 files changed, 122 insertions(+)

diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 2aa850678e..0bf4a305cc 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -19,6 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       run: ${{ steps.filter.outputs.run }}
+      skip-publishing: ${{ steps.publishing.outputs.skip }}
       tests: ${{ steps.tests.outputs.output }}
     steps:
     - uses: envoyproxy/toolshed/actions/github/should-run@5171ddd579f53dcef432bc54e16e2d2c90864968  # actions-v0.4.13
@@ -29,6 +30,27 @@ jobs:
           - 'actions/**'
           - 'js/**'
           - '.github/workflows/actions.yml'
+    - name: Detect cross-stack publish
+      id: publishing
+      if: github.event_name == 'push'
+      shell: bash
+      run: |
+        changed="$(git diff --name-only HEAD^1 HEAD)"
+        self_changed=false
+        others_changed=false
+        while IFS= read -r f; do
+          case "$f" in
+            actions/VERSION.txt) self_changed=true ;;
+            bazel/VERSION.txt|BINS_VERSION.txt|docker/build/VERSION.txt|py/VERSION.txt)
+              others_changed=true ;;
+          esac
+        done <<< "$changed"
+        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
+          echo "skip=true" >> "$GITHUB_OUTPUT"
+          echo "Other stack(s) publishing - skipping heavy jobs"
+        else
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+        fi
     - id: tests
       uses: envoyproxy/toolshed/actions/bson@5171ddd579f53dcef432bc54e16e2d2c90864968  # actions-v0.4.13
       with:
@@ -45,6 +67,7 @@ jobs:
     needs: request
     if: >-
       fromJSON(needs.request.outputs.run)
+      && needs.request.outputs.skip-publishing != 'true'
       && needs.request.outputs.tests != '[]'
     strategy:
       fail-fast: false
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index 1d81d386df..0702fdb641 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -19,6 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       run: ${{ steps.filter.outputs.run }}
+      skip-publishing: ${{ steps.publishing.outputs.skip }}
     steps:
     - uses: envoyproxy/toolshed/actions/github/should-run@5171ddd579f53dcef432bc54e16e2d2c90864968  # actions-v0.4.13
       id: filter
@@ -30,6 +31,27 @@ jobs:
           - bazel/**
           - .github/workflows/bazel.yml
           - .github/workflows/_bazel.yml
+    - name: Detect cross-stack publish
+      id: publishing
+      if: github.event_name == 'push'
+      shell: bash
+      run: |
+        changed="$(git diff --name-only HEAD^1 HEAD)"
+        self_changed=false
+        others_changed=false
+        while IFS= read -r f; do
+          case "$f" in
+            bazel/VERSION.txt|BINS_VERSION.txt) self_changed=true ;;
+            actions/VERSION.txt|docker/build/VERSION.txt|py/VERSION.txt)
+              others_changed=true ;;
+          esac
+        done <<< "$changed"
+        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
+          echo "skip=true" >> "$GITHUB_OUTPUT"
+          echo "Other stack(s) publishing - skipping heavy jobs"
+        else
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+        fi
 
   test:
     permissions:
@@ -39,6 +61,7 @@ jobs:
     if: >-
       always()
       && fromJSON(needs.request.outputs.run || 'false')
+      && needs.request.outputs.skip-publishing != 'true'
     uses: ./.github/workflows/_bazel.yml
     with:
       action: test
@@ -68,6 +91,7 @@ jobs:
     if: >-
       always()
       && fromJSON(needs.request.outputs.run || 'false')
+      && needs.request.outputs.skip-publishing != 'true'
     uses: ./.github/workflows/_bazel.yml
     with:
       action: build
@@ -104,6 +128,7 @@ jobs:
     if: >-
       always()
       && fromJSON(needs.request.outputs.run || 'false')
+      && needs.request.outputs.skip-publishing != 'true'
     uses: ./.github/workflows/_bazel.yml
     with:
       action: build
@@ -134,6 +159,7 @@ jobs:
     if: >-
       always()
       && fromJSON(needs.request.outputs.run || 'false')
+      && needs.request.outputs.skip-publishing != 'true'
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index e723633fa5..a55d5db5cc 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -20,6 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       run: ${{ steps.filter.outputs.run }}
+      skip-publishing: ${{ steps.publishing.outputs.skip }}
     steps:
     - uses: envoyproxy/toolshed/actions/github/should-run@5171ddd579f53dcef432bc54e16e2d2c90864968  # actions-v0.4.13
       id: filter
@@ -30,6 +31,27 @@ jobs:
           - '.github/workflows/docker.yml'
           - '.github/docker-manifests.yml'
           - 'docker/build/VERSION.txt'
+    - name: Detect cross-stack publish
+      id: publishing
+      if: github.event_name == 'push'
+      shell: bash
+      run: |
+        changed="$(git diff --name-only HEAD^1 HEAD)"
+        self_changed=false
+        others_changed=false
+        while IFS= read -r f; do
+          case "$f" in
+            docker/build/VERSION.txt) self_changed=true ;;
+            actions/VERSION.txt|bazel/VERSION.txt|BINS_VERSION.txt|py/VERSION.txt)
+              others_changed=true ;;
+          esac
+        done <<< "$changed"
+        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
+          echo "skip=true" >> "$GITHUB_OUTPUT"
+          echo "Other stack(s) publishing - skipping heavy jobs"
+        else
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+        fi
 
   build:
     runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
@@ -37,6 +59,7 @@ jobs:
     if: >-
       github.repository_owner == 'envoyproxy'
       && fromJSON(needs.request.outputs.run || 'false')
+      && needs.request.outputs.skip-publishing != 'true'
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/py.yml b/.github/workflows/py.yml
index 2c9fde2a1f..d93fb23b7b 100644
--- a/.github/workflows/py.yml
+++ b/.github/workflows/py.yml
@@ -21,6 +21,7 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       run: ${{ steps.filter.outputs.run }}
+      skip-publishing: ${{ steps.publishing.outputs.skip }}
     steps:
     - uses: envoyproxy/toolshed/actions/github/should-run@5171ddd579f53dcef432bc54e16e2d2c90864968  # actions-v0.4.13
       id: filter
@@ -37,6 +38,27 @@ jobs:
           - 'mypy.ini'
           - 'pytest.ini'
           - 'py/**'
+    - name: Detect cross-stack publish
+      id: publishing
+      if: github.event_name == 'push'
+      shell: bash
+      run: |
+        changed="$(git diff --name-only HEAD^1 HEAD)"
+        self_changed=false
+        others_changed=false
+        while IFS= read -r f; do
+          case "$f" in
+            py/VERSION.txt) self_changed=true ;;
+            actions/VERSION.txt|bazel/VERSION.txt|BINS_VERSION.txt|docker/build/VERSION.txt)
+              others_changed=true ;;
+          esac
+        done <<< "$changed"
+        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
+          echo "skip=true" >> "$GITHUB_OUTPUT"
+          echo "Other stack(s) publishing - skipping heavy jobs"
+        else
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+        fi
 
   test:
     runs-on: ubuntu-24.04
@@ -44,6 +66,7 @@ jobs:
     if: >-
       github.repository_owner == 'envoyproxy'
       && fromJSON(needs.request.outputs.run)
+      && needs.request.outputs.skip-publishing != 'true'
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
@@ -67,6 +90,7 @@ jobs:
     needs: request
     if: >-
       fromJSON(needs.request.outputs.run)
+      && needs.request.outputs.skip-publishing != 'true'
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
@@ -85,6 +109,7 @@ jobs:
     needs: request
     if: >-
       fromJSON(needs.request.outputs.run)
+      && needs.request.outputs.skip-publishing != 'true'
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
@@ -124,6 +149,7 @@ jobs:
     # - docs
     if: >-
       fromJSON(needs.request.outputs.run)
+      && needs.request.outputs.skip-publishing != 'true'
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index db23b2eade..bbaa9481bc 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -20,6 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       run: ${{ steps.filter.outputs.run }}
+      skip-publishing: ${{ steps.publishing.outputs.skip }}
     steps:
     - uses: envoyproxy/toolshed/actions/github/should-run@5171ddd579f53dcef432bc54e16e2d2c90864968  # actions-v0.4.13
       id: filter
@@ -29,6 +30,27 @@ jobs:
           - BINS_VERSION.txt
           - 'rust/**'
           - '.github/workflows/rust.yml'
+    - name: Detect cross-stack publish
+      id: publishing
+      if: github.event_name == 'push'
+      shell: bash
+      run: |
+        changed="$(git diff --name-only HEAD^1 HEAD)"
+        self_changed=false
+        others_changed=false
+        while IFS= read -r f; do
+          case "$f" in
+            BINS_VERSION.txt) self_changed=true ;;
+            actions/VERSION.txt|bazel/VERSION.txt|docker/build/VERSION.txt|py/VERSION.txt)
+              others_changed=true ;;
+          esac
+        done <<< "$changed"
+        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
+          echo "skip=true" >> "$GITHUB_OUTPUT"
+          echo "Other stack(s) publishing - skipping heavy jobs"
+        else
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+        fi
 
   test:
     runs-on: ubuntu-24.04
@@ -36,6 +58,7 @@ jobs:
     if: >-
       github.repository_owner == 'envoyproxy'
       && fromJSON(needs.request.outputs.run || 'false')
+      && needs.request.outputs.skip-publishing != 'true'
     strategy:
       fail-fast: false
       matrix:
@@ -70,6 +93,7 @@ jobs:
     if: >-
       always()
       && fromJSON(needs.request.outputs.run || 'false')
+      && needs.request.outputs.skip-publishing != 'true'
     runs-on: ${{ matrix.runs-on }}
     strategy:
       matrix:

From 01efae8c741071b49deec7be24d3ea36bba07c1b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 15 May 2026 14:23:24 +0000
Subject: [PATCH 3/3] Switch publish skip logic to non-dev VERSION state

Agent-Logs-Url: https://github.com/envoyproxy/toolshed/sessions/8eaaf2ae-c138-4ab2-9c94-6adc094dfff4

Co-authored-by: phlax <454682+phlax@users.noreply.github.com>
---
 .github/workflows/actions.yml | 39 ++++++++++++++++++++++-------------
 .github/workflows/bazel.yml   | 39 ++++++++++++++++++++++-------------
 .github/workflows/docker.yml  | 39 ++++++++++++++++++++++-------------
 .github/workflows/py.yml      | 39 ++++++++++++++++++++++-------------
 .github/workflows/rust.yml    | 39 ++++++++++++++++++++++-------------
 5 files changed, 125 insertions(+), 70 deletions(-)

diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 0bf4a305cc..bff565e00f 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -35,21 +35,32 @@ jobs:
       if: github.event_name == 'push'
       shell: bash
       run: |
-        changed="$(git diff --name-only HEAD^1 HEAD)"
-        self_changed=false
-        others_changed=false
-        while IFS= read -r f; do
-          case "$f" in
-            actions/VERSION.txt) self_changed=true ;;
-            bazel/VERSION.txt|BINS_VERSION.txt|docker/build/VERSION.txt|py/VERSION.txt)
-              others_changed=true ;;
-          esac
-        done <<< "$changed"
-        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
-          echo "skip=true" >> "$GITHUB_OUTPUT"
-          echo "Other stack(s) publishing - skipping heavy jobs"
+        is_non_dev() {
+            local file="$1"
+            local version
+            version="$(tr -d '[:space:]' < "$file")"
+            [[ "$version" != *-dev ]]
+        }
+
+        self_publishing=false
+        others_publishing=false
+
+        if is_non_dev actions/VERSION.txt; then
+            self_publishing=true
+        fi
+
+        for file in bazel/VERSION.txt BINS_VERSION.txt docker/build/VERSION.txt py/VERSION.txt; do
+            if is_non_dev "$file"; then
+                others_publishing=true
+                break
+            fi
+        done
+
+        if [[ "$others_publishing" == "true" && "$self_publishing" == "false" ]]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Other stack(s) publishing - skipping heavy jobs"
         else
-          echo "skip=false" >> "$GITHUB_OUTPUT"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
         fi
     - id: tests
       uses: envoyproxy/toolshed/actions/bson@5171ddd579f53dcef432bc54e16e2d2c90864968  # actions-v0.4.13
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index 0702fdb641..04ae9c1377 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -36,21 +36,32 @@ jobs:
       if: github.event_name == 'push'
       shell: bash
       run: |
-        changed="$(git diff --name-only HEAD^1 HEAD)"
-        self_changed=false
-        others_changed=false
-        while IFS= read -r f; do
-          case "$f" in
-            bazel/VERSION.txt|BINS_VERSION.txt) self_changed=true ;;
-            actions/VERSION.txt|docker/build/VERSION.txt|py/VERSION.txt)
-              others_changed=true ;;
-          esac
-        done <<< "$changed"
-        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
-          echo "skip=true" >> "$GITHUB_OUTPUT"
-          echo "Other stack(s) publishing - skipping heavy jobs"
+        is_non_dev() {
+            local file="$1"
+            local version
+            version="$(tr -d '[:space:]' < "$file")"
+            [[ "$version" != *-dev ]]
+        }
+
+        self_publishing=false
+        others_publishing=false
+
+        if is_non_dev bazel/VERSION.txt || is_non_dev BINS_VERSION.txt; then
+            self_publishing=true
+        fi
+
+        for file in actions/VERSION.txt docker/build/VERSION.txt py/VERSION.txt; do
+            if is_non_dev "$file"; then
+                others_publishing=true
+                break
+            fi
+        done
+
+        if [[ "$others_publishing" == "true" && "$self_publishing" == "false" ]]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Other stack(s) publishing - skipping heavy jobs"
         else
-          echo "skip=false" >> "$GITHUB_OUTPUT"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
         fi
 
   test:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index a55d5db5cc..f8c1786d8b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -36,21 +36,32 @@ jobs:
       if: github.event_name == 'push'
       shell: bash
       run: |
-        changed="$(git diff --name-only HEAD^1 HEAD)"
-        self_changed=false
-        others_changed=false
-        while IFS= read -r f; do
-          case "$f" in
-            docker/build/VERSION.txt) self_changed=true ;;
-            actions/VERSION.txt|bazel/VERSION.txt|BINS_VERSION.txt|py/VERSION.txt)
-              others_changed=true ;;
-          esac
-        done <<< "$changed"
-        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
-          echo "skip=true" >> "$GITHUB_OUTPUT"
-          echo "Other stack(s) publishing - skipping heavy jobs"
+        is_non_dev() {
+            local file="$1"
+            local version
+            version="$(tr -d '[:space:]' < "$file")"
+            [[ "$version" != *-dev ]]
+        }
+
+        self_publishing=false
+        others_publishing=false
+
+        if is_non_dev docker/build/VERSION.txt; then
+            self_publishing=true
+        fi
+
+        for file in actions/VERSION.txt bazel/VERSION.txt BINS_VERSION.txt py/VERSION.txt; do
+            if is_non_dev "$file"; then
+                others_publishing=true
+                break
+            fi
+        done
+
+        if [[ "$others_publishing" == "true" && "$self_publishing" == "false" ]]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Other stack(s) publishing - skipping heavy jobs"
         else
-          echo "skip=false" >> "$GITHUB_OUTPUT"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
         fi
 
   build:
diff --git a/.github/workflows/py.yml b/.github/workflows/py.yml
index d93fb23b7b..bffa9820e6 100644
--- a/.github/workflows/py.yml
+++ b/.github/workflows/py.yml
@@ -43,21 +43,32 @@ jobs:
       if: github.event_name == 'push'
       shell: bash
       run: |
-        changed="$(git diff --name-only HEAD^1 HEAD)"
-        self_changed=false
-        others_changed=false
-        while IFS= read -r f; do
-          case "$f" in
-            py/VERSION.txt) self_changed=true ;;
-            actions/VERSION.txt|bazel/VERSION.txt|BINS_VERSION.txt|docker/build/VERSION.txt)
-              others_changed=true ;;
-          esac
-        done <<< "$changed"
-        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
-          echo "skip=true" >> "$GITHUB_OUTPUT"
-          echo "Other stack(s) publishing - skipping heavy jobs"
+        is_non_dev() {
+            local file="$1"
+            local version
+            version="$(tr -d '[:space:]' < "$file")"
+            [[ "$version" != *-dev ]]
+        }
+
+        self_publishing=false
+        others_publishing=false
+
+        if is_non_dev py/VERSION.txt; then
+            self_publishing=true
+        fi
+
+        for file in actions/VERSION.txt bazel/VERSION.txt BINS_VERSION.txt docker/build/VERSION.txt; do
+            if is_non_dev "$file"; then
+                others_publishing=true
+                break
+            fi
+        done
+
+        if [[ "$others_publishing" == "true" && "$self_publishing" == "false" ]]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Other stack(s) publishing - skipping heavy jobs"
         else
-          echo "skip=false" >> "$GITHUB_OUTPUT"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
         fi
 
   test:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index bbaa9481bc..f6785bb4e9 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -35,21 +35,32 @@ jobs:
       if: github.event_name == 'push'
       shell: bash
       run: |
-        changed="$(git diff --name-only HEAD^1 HEAD)"
-        self_changed=false
-        others_changed=false
-        while IFS= read -r f; do
-          case "$f" in
-            BINS_VERSION.txt) self_changed=true ;;
-            actions/VERSION.txt|bazel/VERSION.txt|docker/build/VERSION.txt|py/VERSION.txt)
-              others_changed=true ;;
-          esac
-        done <<< "$changed"
-        if [[ "$others_changed" == "true" && "$self_changed" == "false" ]]; then
-          echo "skip=true" >> "$GITHUB_OUTPUT"
-          echo "Other stack(s) publishing - skipping heavy jobs"
+        is_non_dev() {
+            local file="$1"
+            local version
+            version="$(tr -d '[:space:]' < "$file")"
+            [[ "$version" != *-dev ]]
+        }
+
+        self_publishing=false
+        others_publishing=false
+
+        if is_non_dev BINS_VERSION.txt; then
+            self_publishing=true
+        fi
+
+        for file in actions/VERSION.txt bazel/VERSION.txt docker/build/VERSION.txt py/VERSION.txt; do
+            if is_non_dev "$file"; then
+                others_publishing=true
+                break
+            fi
+        done
+
+        if [[ "$others_publishing" == "true" && "$self_publishing" == "false" ]]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Other stack(s) publishing - skipping heavy jobs"
         else
-          echo "skip=false" >> "$GITHUB_OUTPUT"
+            echo "skip=false" >> "$GITHUB_OUTPUT"
         fi
 
   test: