ci: real paths for release-ci, putitoutthere-config-check and changelog-check

.github/workflows/changelog-check.yml

@@ -3,11 +3,25 @@ name: Changelog Check
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
+# The gate itself decides per package whether a fragment is required
+# (changed_packages / code_touched in internals/checks); these paths only
+# decide whether the decision is worth a runner. packages/** covers both the
+# code that demands a fragment and the fragment dirs that satisfy it, so the
+# near-miss diagnostics (malformed fragment names) still run on
+# fragment-only PRs.
+#
+# plugins/ is deliberately absent: the gate's matchers are hardcoded to
+# packages/<pkg>/, so it cannot see plugin fragments -- running it on a
+# plugin change is a vacuous pass. Plugin changelog enforcement is a gate
+# gap, tracked in its own issue.
 on:
   pull_request:
-    branches: [main]
     paths:
-      - '.github/CI-DISABLED-PLACEHOLDER'
+      - 'packages/**'
+      # Attestations are filtered out of the gate's code_touched, so they
+      # cannot alter its verdict.
+      - '!packages/*/e2e-attestations/**'
+      - '.github/workflows/changelog-check.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/release-config-check.yml → .github/workflows/putitoutthere-config-check.yml

@@ -1,4 +1,4 @@
-name: Release Config Check
+name: putitoutthere Config Check
 
 # Fast PR-time config sanity gate. Runs putitoutthere's `check` reusable
 # workflow, which parses `putitoutthere.toml`, validates the schema, checks
@@ -16,7 +16,8 @@ on:
   pull_request:
     branches: [main]
     paths:
-      - '.github/CI-DISABLED-PLACEHOLDER'
+      - 'putitoutthere.toml'
+      - '.github/workflows/putitoutthere-config-check.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/release-precheck.yml → .github/workflows/release-ci.yml

@@ -1,4 +1,4 @@
-name: Release Precheck
+name: Release CI
 
 # PR-time gate that runs putitoutthere's plan + build matrix using the
 # same `_matrix.yml` reusable workflow that drives the release path.
@@ -14,11 +14,40 @@ name: Release Precheck
 # Pin to `@v0` deliberately: matches what `release.yml` calls so the
 # precheck stays in lockstep with the real release matrix.
 
+# Paths are the union of every [[package]] globs entry in putitoutthere.toml
+# plus the config itself: the plan job change-detects against those same
+# globs, so per-package subdivision happens inside the run (a python-only PR
+# plans only dirsql-py). putitoutthere's build.yml exposes no package filter,
+# and the release cascade (rust -> py -> npm) is cross-package by design, so
+# this stays one workflow rather than splitting per package.
 on:
   pull_request:
     branches: [main]
     paths:
-      - '.github/CI-DISABLED-PLACEHOLDER'
+      - 'packages/rust/**'
+      - '!packages/rust/changelog.d/**'
+      - '!packages/rust/migrations.d/**'
+      - 'packages/python/**'
+      - '!packages/python/changelog.d/**'
+      - '!packages/python/migrations.d/**'
+      - '!packages/python/e2e-attestations/**'
+      - 'packages/ts/**'
+      - '!packages/ts/changelog.d/**'
+      - '!packages/ts/migrations.d/**'
+      - '!packages/ts/e2e-attestations/**'
+      # putitoutthere's plugin globs are plugins/dirsql-plugin-embeddings/**;
+      # README stays in scope here (hatchling embeds it as the PyPI
+      # long-description, so it is a build input), fragments and receipts
+      # do not ship.
+      - 'plugins/dirsql-plugin-embeddings/**'
+      - '!plugins/dirsql-plugin-embeddings/changelog.d/**'
+      - '!plugins/dirsql-plugin-embeddings/migrations.d/**'
+      - '!plugins/dirsql-plugin-embeddings/e2e-attestations/**'
+      - '!plugins/dirsql-plugin-embeddings/tests/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'putitoutthere.toml'
+      - '.github/workflows/release-ci.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}