paths-filter for detection

Lockfile in filter

fetch-depth 0 on changes job

Lane conditional build

Deploy non-cancellable

Verify/e2e cancellable

Concurrency group lane-scoped

Shared concurrency key

Explicit result check

Manual deploy workflow

ref input to checkout

Independent lane verification

No rebuild in deploy

Artifact downloaded in e2e

Upload version v7

if-no-files-found error

include-hidden-files

Unique artifact name

Separate stages

Smoke step present

Smoke step fails on non-200

GITHUB_STEP_SUMMARY

Deploy needs both verify and e2e

1Password for runtime env

op:// references in template

OIDC for cloud credentials

id-token write at job level

Root permissions minimal

No secrets as CLI flags

No env file dump

account-id in vars not secrets

Fine-grained PAT

GitHub secrets only for bootstrap

Env rendered in runner not VPS

Uses local composite action

Composite matches sibling shape

Artifact pass-through

E2E uses artifact

Smoke after deploy

Smoke fails closed

No unexplained marketplace swap

Mentions sibling precedent

Uses narrow credentials

Deploy concurrency safe