improvement(ci): avoid unrelated asset checks and browser downloads

.github/scripts/http-e2e.sh

@@ -233,7 +233,7 @@ case "$group" in
     export COPILOT_TOOL_PERMISSIONS_ENABLED=true
     export KNOWLEDGE_MEMBER_ACCESS=true CREDENTIAL_GROUPS=true ACCESS_CONTROL_ENABLED=true
     export NEXT_PUBLIC_ACCESS_CONTROL_ENABLED=true NEXT_PUBLIC_ORGANIZATIONS_ENABLED=true
-    if [ "$group" != desktop-inbox ]; then start_browser_install "$group" chromium; fi
+    if [ "$group" != desktop-inbox ]; then start_browser_install "$group" --only-shell chromium; fi
     export INTERNAL_API_SECRET=desktop-inbox-http-ci-local-secret-at-least-32-characters
     export DB_TX_TRIPWIRE=throw
     start_app "$group" 3019 "$group" record-http-status
@@ -275,7 +275,7 @@ case "$group" in
     export KNOWLEDGE_MEMBER_ACCESS=true CREDENTIAL_GROUPS=true ACCESS_CONTROL_ENABLED=true
     export NEXT_PUBLIC_ACCESS_CONTROL_ENABLED=true
     export API_ENCRYPTION_KEY="$ENCRYPTION_KEY"
-    start_browser_install "$group" chromium
+    start_browser_install "$group" --no-shell chromium
     extension_identity=$(bun - <<'JS'
       import { generateKeyPairSync, createHash } from 'node:crypto'
       const { publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
@@ -312,7 +312,7 @@ JS
     export INTERNAL_API_SECRET=mobile-http-ci-local-secret-at-least-32-characters
     export NEXT_PUBLIC_SOCKET_URL=http://127.0.0.1:3025 SOCKET_SERVER_URL=http://127.0.0.1:3025
     read -ra browsers <<< "${MOBILE_E2E_BROWSER:-chromium webkit}"
-    start_browser_install mobile "${browsers[@]}"
+    start_browser_install mobile --only-shell "${browsers[@]}"
     start_app mobile 3024 'mobile browser' record-http-status
     start_realtime mobile 3025
     wait_for_browsers

.github/workflows/docs-negotiation.yml

@@ -342,9 +342,6 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-        with:
-          fetch-depth: 0
-          filter: blob:none
       - name: Setup workspace
         uses: ./.github/actions/setup
         with:
@@ -376,7 +373,7 @@ jobs:
         if: matrix.group == 'chromium' || matrix.group == 'webkit'
         env:
           BROWSER: ${{ matrix.group }}
-        run: bunx --no-install playwright install --with-deps "$BROWSER"
+        run: bunx --no-install playwright install --with-deps --only-shell "$BROWSER"
       - name: Verify production documentation
         env:
           DOCS_ACCEPTANCE_GROUP: ${{ matrix.group }}

apps/sim/turbo.json

@@ -9,6 +9,7 @@
         "!app/(landing)/**",
         "!app/api/**",
         "!content/**",
+        "!public/library/**",
         "!tools/**",
         "!providers/**",
         "!blocks/**",
@@ -151,7 +152,12 @@
     },
     "ci:e2e-seo": {
       "dependsOn": ["ci:server", "ci:ui"],
-      "inputs": ["app/(landing)/**", "content/**", "scripts/test-landing-seo-e2e.ts"],
+      "inputs": [
+        "app/(landing)/**",
+        "content/**",
+        "public/library/**",
+        "scripts/test-landing-seo-e2e.ts"
+      ],
       "cache": false
     },
     "ci:desktop-live": {

scripts/ci-changes.test.ts

@@ -181,6 +181,44 @@ describe('CI task attribution through real Turborepo', () => {
       build: true,
     })
   })
+  it.each([
+    ['apps/sim/public/library/example/cover.jpg'],
+    ['apps/sim/content/library/example/index.mdx', 'apps/sim/public/library/example/cover.jpg'],
+  ])('keeps library media on the rendering and SEO path: %j', (...files) => {
+    const plan = classifyFiles(files)
+    expect(plan.fallback).toBeUndefined()
+    expect(groups(plan)).toEqual(['seo'])
+    expect(plan.docsGroups).toEqual([])
+    expect(plan.flags).toMatchObject({
+      integration: false,
+      desktop_live: false,
+      production: false,
+      test_app: true,
+      build: true,
+      e2e_build: true,
+    })
+  })
+  it.each(['delete', 'move'])('keeps SEO coverage when library media is removed: %s', (change) => {
+    const { repo } = fixture()
+    const media = 'apps/sim/public/library/example/cover.jpg'
+    write(repo, media, 'fixture media')
+    git(repo, 'add', '-A')
+    git(repo, 'commit', '--quiet', '-m', 'media base')
+    const base = git(repo, 'rev-parse', 'HEAD')
+    if (change === 'delete') git(repo, 'rm', media)
+    else git(repo, 'mv', media, 'apps/sim/public/library/example/renamed.jpg')
+    git(repo, 'commit', '--quiet', '-m', change)
+    const plan = classify(repo, base)
+    expect(plan.fallback).toBeUndefined()
+    expect(groups(plan)).toEqual(['seo'])
+    expect(plan.flags).toMatchObject({
+      build: true,
+      e2e_build: true,
+      integration: false,
+      desktop_live: false,
+      docs: false,
+    })
+  })
   it.each([
     'apps/sim/app/workspace/[workspaceId]/upgrade/components/comparison-table/comparison-data.ts',
     'apps/sim/providers/models.ts',
@@ -344,15 +382,15 @@ describe('CI task attribution through real Turborepo', () => {
       build: true,
     })
   })
-  it('keeps unknown app modules and non-code fixtures in the shared runtime boundary', () => {
-    for (const path of [
-      'apps/sim/new-domain/feature.ts',
-      'apps/sim/tools/service/__fixtures__/README.md',
-    ]) {
-      const plan = classifyFiles([path])
-      expect(plan.fallback).toBeUndefined()
-      expect(plan.flags).toMatchObject({ integration: true, desktop_live: true, e2e_build: true })
-    }
+  it.each([
+    'apps/sim/new-domain/feature.ts',
+    'apps/sim/public/new-domain/config.json',
+    'apps/sim/public/favicon/favicon.ico',
+    'apps/sim/tools/service/__fixtures__/README.md',
+  ])('keeps unclassified runtime files in the shared boundary: %s', (path) => {
+    const plan = classifyFiles([path])
+    expect(plan.fallback).toBeUndefined()
+    expect(plan.flags).toMatchObject({ integration: true, desktop_live: true, e2e_build: true })
   })
   it.each([
     '.github/workflows/checks.yml',