fix: allow public source manifest

Validated workflow-only runner optimization. [skip ci]

.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf

.gitea/workflows/managed-validation.yml

@@ -50,7 +50,34 @@ jobs:
             echo "Unresolved merge markers detected" >&2
             exit 1
           fi
-          # Checkout recreates only `origin`; restore the documented upstream
+
+          # MANAGED_FAST_PATH: documentation and this baseline workflow cannot
+          # affect the shipped runtime. Keep the required status check, but do
+          # not install toolchains or execute the full product suite.
+          if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
+            git fetch --no-tags --depth=1 origin "${GITHUB_BASE_REF}"
+            managed_base="origin/${GITHUB_BASE_REF}"
+            git diff --check "${managed_base}..HEAD"
+            mapfile -t managed_changed_files < <(
+              git diff --name-only --diff-filter=ACMR "${managed_base}..HEAD"
+            )
+            managed_runtime_change=0
+            for managed_path in "${managed_changed_files[@]}"; do
+              case "${managed_path}" in
+                *.md|*.mdx|docs/*|.github/ISSUE_TEMPLATE/*|.gitea/ISSUE_TEMPLATE/*|.gitea/runner-scope.sh|.gitea/workflows/managed-validation.yml)
+                  ;;
+                *)
+                  managed_runtime_change=1
+                  break
+                  ;;
+              esac
+            done
+            if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then
+              printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \
+                "${#managed_changed_files[@]}"
+              exit 0
+            fi
+          fi          # Checkout recreates only `origin`; restore the documented upstream
           # identity required by the fork-boundary guard. The pinned baseline
           # tag is already part of this repository, so no upstream fetch occurs.
           git remote add upstream https://gitlab.com/CalcProgrammer1/OpenRGB.git

PUBLIC-SOURCE-MANIFEST.sha256

@@ -1,7 +1,8 @@
 004f81f60cd94f40a4190a251207046c49947a18665acd9d286d4ed37262000c  .dockerignore
 d60541998d51c1858da15f04afb54b28db56c21b86217c3cb7fc3d7ddb15c406  .editorconfig
 b31877c3a1005f270a5814a32e1d3ea3e6ae88eb7857ba578dd0931d6d8517c5  .env.example
-c72d7473cb0746b3eb542ec0fbbf6ef3cf1fc9ca764d703e6209a8949a2ab890  .gitea/workflows/managed-validation.yml
+1d5d71dcc6ccd28ab46a335349ecc74742ca4b81f4fcad212f8d134f70f1f13e  .gitattributes
+54afa75021dfc20d1877132876c7808803f45568404efe27a80432a37aa43aa4  .gitea/workflows/managed-validation.yml
 37071ae4aaa1cbeacdf6560459e0c2302b620d998500c42012c87c16574018a8  .github/FUNDING.yml
 2c1e738d39017495aabd2daf47b0cab54c5442362c51f1c08cd460297a9308c0  .github/workflows/issue_opened.yml
 47ff2411d0e07423534fbf69fee1c5b1a1a26ed98aa7adc9ae0c9f5427bcba17  .github/workflows/openrgb_upstream_compat_guard.yml
@@ -2336,7 +2337,7 @@ d367db3868ac46b452ebe8ae758a75363b24024478f7d53574ca11c46e190bc7  scripts/Licens
 8ea8d87553b95b73d5fe1cc8c84d955f5091cf2572914364f549461a424bd25b  scripts/git-get-branch.sh
 172c4f52c197f427c79446134e0d810011ba2ce5ba89e03db156c3675608c8d1  scripts/openrgb-udev-install.sh
 f527c95d094238b3a5cee99390bcd58704c1a17432f39d48ffc89ebafa80a7ba  scripts/openrgb-upstream-guard.ps1
-da805501744cfb3726f1c36bc91d1a42ee5c1d9cc32cbb9834336c579216734e  scripts/openrgb-upstream-guard.sh
+8845d95025929f8a2202fb79fe7d00c7d5cf8b87a1d80aafb878fdf17bb8d0f0  scripts/openrgb-upstream-guard.sh
 aeedc69310db069e52bd770f2882046e6aa2f93c063218c6eac23e422f49113a  scripts/prepare-artifacts.py
 7ec8f32a79030ba625c2b7f444f3b22d70a94a983ab66189890b22b0a8cff6ea  scripts/redeploy-lumaops.ps1
 dd3e9e8f73b0c504c55a399ba5a5bccc9db6e9a1a596e4cc214a3762484a0058  scripts/redeploy-lumaops.sh

scripts/openrgb-upstream-guard.sh

@@ -41,7 +41,7 @@ declare -a UNEXPECTED_FILES=()
 for file in "${CHANGED_FILES[@]}"; do
     allowed=0
     case "$file" in
-        .dockerignore|.env.example|.gitleaks.toml|.gitignore|Dockerfile|README.md|SECURITY.md|docker-compose*.yml|docker-compose*.yaml|startup/main_FreeBSD_Linux_MacOS.cpp|ResourceManager.cpp|ResourceManager.h|.github/*|.gitea/*)
+        .dockerignore|.env.example|.gitattributes|.gitleaks.toml|.gitignore|Dockerfile|PUBLIC-SOURCE-MANIFEST.sha256|README.md|SECURITY.md|docker-compose*.yml|docker-compose*.yaml|startup/main_FreeBSD_Linux_MacOS.cpp|ResourceManager.cpp|ResourceManager.h|.github/*|.gitea/*)
             allowed=1
             ;;
         docs/*|lumaops/*|docker/*|scripts/*)