ci: only build when image-affecting files change

Add path filters so the workflow runs only when the Dockerfile, nginx config,
site assets or .dockerignore change. CI-config, Renovate-config and docs
changes (such as a Renovate bump of a CI action) no longer trigger a build or
release. workflow_dispatch is added for manual runs after pipeline changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-and-publish.yml

@@ -1,10 +1,31 @@
 name: Build and publish container
 
+# Only run when files that affect the built image change. Updates to CI
+# config, Renovate config, or docs (e.g. a Renovate bump of the checkout
+# action) do not change the image and so do not trigger a build or release.
+# Use workflow_dispatch to run manually after a pipeline change.
 on:
   push:
     branches: [main]
+    paths:
+      - 'Dockerfile'
+      - 'default.conf'
+      - 'index.html'
+      - 'styles.css'
+      - 'script.js'
+      - 'messages.js'
+      - '.dockerignore'
   pull_request:
     branches: [main]
+    paths:
+      - 'Dockerfile'
+      - 'default.conf'
+      - 'index.html'
+      - 'styles.css'
+      - 'script.js'
+      - 'messages.js'
+      - '.dockerignore'
+  workflow_dispatch:
 
 defaults:
   run:

Dockerfile

@@ -1,7 +1,7 @@
 # Lightweight, non-root nginx serving the static site.
 # Runs as user "nginx" and listens on 8080, ready to sit behind an
 # external reverse proxy that terminates TLS and forwards requests.
-FROM nginxinc/nginx-unprivileged:1.27-alpine-slim
+FROM nginxinc/nginx-unprivileged:1.31-alpine-slim@sha256:6616de6eaa82bc2ee3541fa287a8fca7dc7271e6374e9402014dbd13f4a980ae
 
 COPY default.conf /etc/nginx/conf.d/default.conf
 COPY --chown=nginx:nginx index.html styles.css script.js messages.js /usr/share/nginx/html/

messages.js

@@ -11,8 +11,13 @@
  */
 
 const MESSAGES = [
-  "PLACEHOLDER: write your first reason here",
-  "PLACEHOLDER: write another reason here",
-  // Add as many entries as you like, one per line:
-  // "Your reason here",
+  "Maggie came back, she was unimpressed",
+  "They mixed up the B23s and the 2024 tube stock",
+  "The computer went on strike",
+	"Leaves on the track",
+	"Escalators broke at Cutty Sark",
+	"EHRC decided it was woke",
+	"JK Rowling",
+	"Kaiju",
+	"28 Days Later happened",
 ];