ci: gate jobs by changed paths and merge Go lint with test

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,106 @@
+name: Bug report
+description: Report a problem with canton-devkit or a LocalNet instance
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing, run `canton-devkit localnet doctor` and check [troubleshooting](https://github.com/bitdynamics-ab/canton-devkit/blob/main/docs/troubleshooting.md).
+        Redact JWTs, party IDs, and other secrets from pasted output.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What went wrong?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Numbered steps to trigger the issue.
+      placeholder: |
+        1. Run `canton-devkit localnet up demo`
+        2. Run `canton-devkit localnet status --name demo`
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: canton-devkit version
+      description: Output of `canton-devkit version` or `dpm version`.
+      placeholder: e.g. v0.1.0
+    validations:
+      required: true
+
+  - type: input
+    id: splice_version
+    attributes:
+      label: Splice / LocalNet version
+      description: If applicable.
+      placeholder: e.g. 0.6.4, token-standard-v2
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface
+      options:
+        - CLI
+        - Web UI
+        - Both
+        - Unsure
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: OS / platform
+      options:
+        - macOS
+        - Linux
+        - Windows
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: instance
+    attributes:
+      label: Instance name
+      description: If applicable.
+      placeholder: e.g. demo
+
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Diagnostic output
+      description: Paste `canton-devkit localnet doctor` output (redact secrets).
+      render: shell
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / command output
+      description: stderr, docker compose output, or other relevant output.
+      render: shell

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Summary
+
+<!-- 1-3 sentences: what changed and why -->
+
+## Changes
+
+<!-- bullet list; omit section for trivial fixes -->
+
+## Test plan
+
+- [ ] `make test`
+- [ ] `make lint`
+- [ ] `scripts/e2e-milestone1.sh`
+- [ ] <!-- manual verification steps -->
+
+## Checklist
+
+- [ ] Tests pass locally
+- [ ] No coverage regression on touched code
+- [ ] Docs updated (and `website/` synced if any mirrored `docs/*.md` changed)
+- [ ] CLI ↔ Web UI parity maintained (or follow-up issue + `TODO(#issue)` comment)

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
       - "go.mod"
       - "go.sum"
       - ".github/workflows/ci.yml"
+      - "install.sh"
       - "docs/design/mockups/**.jsx"
       - "frontend/**"
       - "Makefile"
@@ -26,6 +27,7 @@ on:
       - "go.mod"
       - "go.sum"
       - ".github/workflows/ci.yml"
+      - "install.sh"
       - "docs/design/mockups/**.jsx"
       - "frontend/**"
       - "Makefile"
@@ -40,8 +42,44 @@ permissions:
   contents: read
 
 jobs:
-  test:
-    name: Build and test
+  changes:
+    name: Detect changed paths
+    runs-on: [self-hosted, Linux]
+    outputs:
+      go: ${{ steps.filter.outputs.go }}
+      install_sh: ${{ steps.filter.outputs.install_sh }}
+      frontend: ${{ steps.filter.outputs.frontend }}
+      mockups: ${{ steps.filter.outputs.mockups }}
+    steps:
+      - name: Check out repository
+        # actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      - name: Filter changed paths
+        # dorny/paths-filter@v4.0.2
+        id: filter
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
+        with:
+          filters: |
+            go:
+              - '**/*.go'
+              - 'go.mod'
+              - 'go.sum'
+              - 'Makefile'
+              - 'internal/skills/docs/**'
+              - 'packaging/**'
+              - '.github/workflows/ci.yml'
+            install_sh:
+              - 'install.sh'
+            frontend:
+              - 'frontend/**'
+              - 'Makefile'
+            mockups:
+              - 'docs/design/mockups/**.jsx'
+
+  go:
+    name: Build, lint, and test
+    needs: changes
+    if: needs.changes.outputs.go == 'true' || needs.changes.outputs.install_sh == 'true'
     runs-on: [self-hosted, Linux]
 
     steps:
@@ -56,10 +94,23 @@ jobs:
           go-version-file: go.mod
           cache: false
 
+      - name: Validate install.sh syntax
+        if: needs.changes.outputs.install_sh == 'true'
+        run: sh -n install.sh
+
+      - name: Run golangci-lint
+        if: needs.changes.outputs.go == 'true'
+        # golangci/golangci-lint-action@v9.2.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20
+        with:
+          version: v2.12.2
+
       - name: Build
+        if: needs.changes.outputs.go == 'true'
         run: go build ./...
 
       - name: Test
+        if: needs.changes.outputs.go == 'true'
         run: go test ./...
 
   mockup-syntax:
@@ -69,6 +120,8 @@ jobs:
     # browser. esbuild's `--loader=jsx` is the cheapest JSX-aware parser
     # available; no node_modules install needed.
     name: Mockup JSX syntax
+    needs: changes
+    if: needs.changes.outputs.mockups == 'true'
     runs-on: [self-hosted, Linux]
     steps:
       - name: Check out repository
@@ -90,39 +143,19 @@ jobs:
               || { echo "::error file=$f::JSX syntax error"; exit 1; }
           done
 
-  lint:
-    name: Lint
-    runs-on: [self-hosted, Linux]
-
-    steps:
-      - name: Check out repository
-        # actions/checkout@v5
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
-
-      - name: Set up Go
-        # actions/setup-go@v6
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
-        with:
-          go-version-file: go.mod
-          cache: false
-
-      - name: Run golangci-lint
-        # golangci/golangci-lint-action@v9.2.0
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20
-        with:
-          version: v2.12.2
-
   frontend:
-    # Frontend lint + typecheck + Vitest suite. Gated on
-    # frontend/** + Makefile path filters above, so a Go-only
-    # change doesn't pay the npm-install cost.
+    # Frontend typecheck + Vitest suite. Job-level path filter (via the
+    # `changes` job) skips this when only Go/mockup/install.sh files
+    # change, so a Go-only PR doesn't pay the npm-install cost.
     #
     # Deliberately does NOT run `npm run build` — the production
     # bundle goes through `make frontend` at release time
     # (release.yml), which also runs `go build` and proves
     # //go:embed picks it up. This job is the per-PR fast loop:
     # tsc + vitest, ~30s on a warm runner.
     name: Frontend test
+    needs: changes
+    if: needs.changes.outputs.frontend == 'true'
     runs-on: [self-hosted, Linux]
 
     steps:

.github/workflows/docs.yml

@@ -0,0 +1,65 @@
+name: docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "website/**"
+      - "docs/**"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# One Pages deployment at a time; don't cancel an in-flight production deploy.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build site
+    runs-on: [self-hosted, Linux]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: website/.nvmrc
+          cache: npm
+          cache-dependency-path: website/package-lock.json
+
+      - name: Install dependencies
+        working-directory: website
+        run: npm ci
+
+      - name: Build
+        working-directory: website
+        run: npm run build
+
+      - name: Configure Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: website/dist
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: [self-hosted, Linux]
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/e2e.yml → .github/workflows/e2e-test-devkit-functions.yml

@@ -1,4 +1,4 @@
-name: E2E
+name: "E2E: canton-devkit Functions"
 
 # Shell-based end-to-end tests. Each milestone adds a job to this
 # workflow. Currently: Milestone 1 (LocalNet CLI lifecycle).
@@ -56,6 +56,14 @@ jobs:
         run: |
           for name in e2e-test-default e2e-named-test e2e-version-test e2e-bad-version; do
             docker compose -p "canton-${name}" down --volumes 2>/dev/null || true
+            # `compose down --volumes` only removes volumes Compose itself
+            # created; volumes left by a prior run get re-adopted as
+            # external and survive. On this persistent self-hosted runner
+            # that strands canton-<name>_postgres / _domain-upgrade-dump and
+            # trips M1-CLN-001's "volumes remain after clean" check. Remove
+            # them explicitly by project-name prefix to guarantee a clean slate.
+            docker volume ls -q --filter "name=^canton-${name}_" \
+              | xargs -r docker volume rm -f 2>/dev/null || true
             rm -f "$HOME/.canton-devkit/localnet/${name}/.lock"
           done
 
@@ -74,5 +82,9 @@ jobs:
         run: |
           for name in e2e-test-default e2e-named-test e2e-version-test e2e-bad-version; do
             docker compose -p "canton-${name}" down --volumes 2>/dev/null || true
+            # Also drop adopted/external volumes Compose won't remove, so the
+            # next run on this persistent runner starts from a clean slate.
+            docker volume ls -q --filter "name=^canton-${name}_" \
+              | xargs -r docker volume rm -f 2>/dev/null || true
           done
           rm -f /tmp/e2e-m1-snapshot.tgz