ci: only rebuild images whose files changed

Add a changes job that diffs the pushed range (or PR base) and emits a matrix
via ci-matrix.sh. Shared files or build tooling changes rebuild all images.
Also fix the upstream package trim to drop top-level keys left empty (e.g.
packages-x86_64 when every entry is excluded), which broke fedora-remote.

.gitea/workflows/build.yaml

@@ -11,28 +11,42 @@ on:
     - cron: "0 4 * * 1"
 
 jobs:
+  # Work out which images actually changed, so a push only rebuilds those.
+  changes:
+    name: Compute build matrix
+    runs-on: job-v2
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Compute matrix
+        id: matrix
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "push" \
+                && -n "${{ github.event.before }}" \
+                && "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]]; then
+            changed="$(git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" || true)"
+          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            changed="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" || true)"
+          else
+            changed=""
+          fi
+          matrix="$(printf '%s\n' "${changed}" | ./ci-matrix.sh)"
+          echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
+
   build:
     name: ${{ matrix.image }} (${{ matrix.distro }})
+    needs: changes
     runs-on: ${{ matrix.runner }}
 
     strategy:
       fail-fast: false
-      # To build another image, add images/<name>/{manifest.yaml,build.conf}
-      # and a matching matrix entry here.
-      matrix:
-        include:
-          - image: fedora-cosmic
-            distro: "44"
-            arch: x86_64
-            runner: job-v2
-          - image: fedora-cosmic
-            distro: rawhide
-            arch: x86_64
-            runner: job-v2
-          - image: fedora-remote
-            distro: "44"
-            arch: x86_64
-            runner: job-v2
+      matrix: ${{ fromJson(needs.changes.outputs.matrix) }}
 
     container:
       image: "quay.io/fedora-ostree-desktops/buildroot:${{ matrix.distro }}"
@@ -125,11 +139,10 @@ jobs:
           ./release.sh "${IMAGE}" "${DISTRO}" "${buildid}" "${pkgs}"
 
   prune:
-    name: Prune old releases
+    name: Prune old releases and tags
     runs-on: job-v2
-    needs: build
-    # Run even if some matrix builds failed (e.g. rawhide churn), so their old
-    # releases still get cleaned up.
+    needs: [changes, build]
+    # Run even if some matrix builds failed (e.g. rawhide churn).
     if: ${{ always() && github.event_name != 'pull_request' }}
     container:
       image: "quay.io/fedora-ostree-desktops/buildroot:44"