Fix workflow race condition and sidecar path filter

- Add git pull --rebase before push in both version bump workflows to
  handle concurrent pushes from parallel workflows
- Add explicit python/ change detection in sidecar workflow (Gitea may
  not support paths filter), skip all jobs if no python changes
- Gate all sidecar build jobs on has_changes output

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/build-sidecar.yml

@@ -14,6 +14,7 @@ jobs:
     outputs:
       version: ${{ steps.bump.outputs.version }}
       tag: ${{ steps.bump.outputs.tag }}
+      has_changes: ${{ steps.check_changes.outputs.has_changes }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -45,7 +46,25 @@ jobs:
           echo "version=${NEW_VERSION}" >> $GITHUB_OUTPUT
           echo "tag=sidecar-v${NEW_VERSION}" >> $GITHUB_OUTPUT
 
+      - name: Check for python changes
+        id: check_changes
+        run: |
+          # If triggered by workflow_dispatch, always build
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          # Check if any python/ files changed in this commit
+          CHANGED=$(git diff --name-only HEAD~1 HEAD -- python/ || echo "")
+          if [ -n "$CHANGED" ]; then
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+            echo "No python/ changes detected, skipping sidecar build"
+          fi
+
       - name: Commit and tag
+        if: steps.check_changes.outputs.has_changes == 'true'
         env:
           BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
         run: |
@@ -55,12 +74,14 @@ jobs:
           git commit -m "chore: bump sidecar version to ${NEW_VERSION} [skip ci]"
           git tag "${TAG}"
 
-          # Push using token for authentication
+          # Push using token for authentication (rebase in case another workflow pushed first)
           REMOTE_URL=$(git remote get-url origin | sed "s|://|://gitea-actions:${BUILD_TOKEN}@|")
+          git pull --rebase "${REMOTE_URL}" main || true
           git push "${REMOTE_URL}" HEAD:main
           git push "${REMOTE_URL}" "${TAG}"
 
       - name: Create Gitea release
+        if: steps.check_changes.outputs.has_changes == 'true'
         env:
           BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
         run: |
@@ -79,6 +100,7 @@ jobs:
   build-sidecar-linux:
     name: Build Sidecar (Linux)
     needs: bump-sidecar-version
+    if: needs.bump-sidecar-version.outputs.has_changes == 'true'
     runs-on: ubuntu-latest
     env:
       PYTHON_VERSION: "3.11"
@@ -172,6 +194,7 @@ jobs:
   build-sidecar-windows:
     name: Build Sidecar (Windows)
     needs: bump-sidecar-version
+    if: needs.bump-sidecar-version.outputs.has_changes == 'true'
     runs-on: windows-latest
     env:
       PYTHON_VERSION: "3.11"
@@ -293,6 +316,7 @@ jobs:
   build-sidecar-macos:
     name: Build Sidecar (macOS)
     needs: bump-sidecar-version
+    if: needs.bump-sidecar-version.outputs.has_changes == 'true'
     runs-on: macos-latest
     env:
       PYTHON_VERSION: "3.11"

.gitea/workflows/release.yml

@@ -59,8 +59,9 @@ jobs:
           git commit -m "chore: bump version to ${NEW_VERSION} [skip ci]"
           git tag "v${NEW_VERSION}"
 
-          # Push using token for authentication
+          # Push using token for authentication (rebase in case another workflow pushed first)
           REMOTE_URL=$(git remote get-url origin | sed "s|://|://gitea-actions:${BUILD_TOKEN}@|")
+          git pull --rebase "${REMOTE_URL}" main || true
           git push "${REMOTE_URL}" HEAD:main
           git push "${REMOTE_URL}" "v${NEW_VERSION}"