ci(release): require and enforce [skip ci] on notes-only commits; ignore codex-cli/package.json; keep push-to-main with paths-ignore

.github/workflows/release.yml

@@ -12,6 +12,7 @@ on:
       - 'CHANGELOG.md'
       - 'release-notes/**'
       - '.github/workflows/release.yml'
+      - 'codex-cli/package.json'
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -293,8 +294,8 @@ jobs:
     name: Publish to npm
     needs: [determine-version, build-binaries]
     runs-on: ubuntu-latest
+    if: "!contains(github.event.head_commit.message, '[skip ci]')"
     timeout-minutes: 30
-    # On tag or manual dispatch; no need to skip based on commit message
     env:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -556,7 +557,7 @@ jobs:
           - Explore codebase directly if commit messages are unclear or need additional context.
           - Keep formatting minimal (headers + list bullets). No emojis ever! Basic markdown only.
           - Never reorder older versions. Only touch the section for v${NEW_VERSION}.
-          - After writing files, stage and commit with message: docs(changelog): update for v${NEW_VERSION}
+          - After writing files, stage and commit with message: docs(changelog): update for v${NEW_VERSION} [skip ci]
 
           Context (git log excerpt follows):
           PROMPT
@@ -579,6 +580,28 @@ jobs:
             git commit -m "docs(changelog): update for v${NEW_VERSION} [skip ci]" || true
           fi
 
+      - name: Enforce [skip ci] on notes-only commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          # If HEAD only touched notes files and lacks [skip ci], amend the subject to include it.
+          mapfile -t files < <(git show --name-only --pretty="" HEAD)
+          notes_only=true
+          for f in "${files[@]}"; do
+            [ -z "$f" ] && continue
+            case "$f" in
+              CHANGELOG.md|release-notes/RELEASE_NOTES.md) ;; # allowed
+              *) notes_only=false ;;
+            esac
+          done
+          if [ "$notes_only" = true ]; then
+            subj=$(git log -1 --pretty=%s || true)
+            if ! grep -q '\[skip ci\]' <<<"$subj"; then
+              body=$(git log -1 --pretty=%b || true)
+              git commit --amend -m "${subj} [skip ci]" -m "$body"
+            fi
+          fi
+
       - name: Fallback release notes from CHANGELOG (no OPENAI_API_KEY)
         if: env.OPENAI_API_KEY == ''
         shell: bash