fix(validate.yml): rootfs/ base-input detection (anchored-group regex bug)

The detect step's regex '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$' anchored
the whole alternation with a trailing $, so the rootfs/ branch only matched a
file literally named 'rootfs/' — never real paths like
rootfs/usr/local/lib/opencode-devbox/generate-config.py (which Dockerfile.base
COPYs into the base). Result: rootfs-only base changes set base_changed=false and
validate-base/validate-omos ran against the stale base-latest instead of skipping
(observed live: run 429, my own generate-config.py commit, did not skip).

Fix: compute the match once into $changed with rootfs/ as a PREFIX
('^(Dockerfile\.base$|rootfs/|entrypoint.*\.sh$)') and gate on -n; reuse it for
the file listing so the two greps can't drift. Bug predates the skip feature
(introduced in dba05da); the skip in 703edbe made it load-bearing.

actionlint clean; detect logic simulated across rootfs/Dockerfile.base/entrypoint/
docs-only change-sets.

.gitea/workflows/validate.yml

@@ -83,12 +83,18 @@ jobs:
         id: detect
         run: |
           set -e
-          if git diff --name-only HEAD~1 HEAD 2>/dev/null \
+          # Base inputs baked into Dockerfile.base: Dockerfile.base itself, any
-              | grep -qE '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$'; then
+          # file under rootfs/ (COPYed into the base), and entrypoint*.sh. NB:
+          # rootfs/ is a PREFIX match — the earlier '^(...|rootfs/|...)$' anchored
+          # the whole group, so the rootfs/ branch only matched a file literally
+          # named 'rootfs/' and never real paths like rootfs/usr/.../x.py.
+          base_re='^(Dockerfile\.base$|rootfs/|entrypoint.*\.sh$)'
+          changed="$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep -E "$base_re" || true)"
+          if [ -n "$changed" ]; then
             echo "base_changed=true" >> "$GITHUB_OUTPUT"
             echo "::warning::This commit changes base-image inputs (Dockerfile.base, rootfs/, or entrypoint*.sh). validate.yml uses Hub's base-latest as the parent for variant builds, so the new base is NOT exercised by this workflow — validate-base/validate-omos are SKIPPED to avoid a false failure against the stale base-latest. Cut a release tag, or run a workflow_dispatch of docker-publish-split.yml against a test tag (e.g. v0.0.0-base-test, promote_latest=false) for end-to-end validation of the new base."
             echo "Changed base-input files:"
-            git diff --name-only HEAD~1 HEAD | grep -E '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$'
+            printf '%s\n' "$changed"
           else
             echo "base_changed=false" >> "$GITHUB_OUTPUT"
             echo "No base-image inputs changed in this commit — validate.yml fully exercises the published base-latest."

CHANGELOG.md

@@ -35,7 +35,11 @@ Tags follow **independent semver** (since `v2.0.0`) — they version *this image
   The `base-change-warning` job now exports a `base_changed` output and those two
   jobs **skip** when base inputs changed, deferring full base validation to the
   release path (`docker-publish-split.yml`). The scary red becomes a neutral skip
-  plus the existing warning.
+  plus the existing warning. Also fixes the base-input detector itself: its
+  `^(…|rootfs/|…)$` regex anchored the whole alternation, so the `rootfs/` branch
+  only matched a file literally named `rootfs/` and never real paths like
+  `rootfs/usr/…/generate-config.py` — `rootfs/` is now a prefix match, so
+  rootfs-only base changes are detected too.
 
 ---