fix(ci): an executable file is CODE wherever it lives, including under docs/ (#1200)

[wshallwshall]

ci.yml's docs-only short-circuit skips install, lint, type-check and the whole of pytest when every changed path is docs-only. ^docs/ is an alternation branch, so it matched a .py under docs/ and short-circuited before the stated *.py rule was ever reached.

A defect here does not fail loudly — it removes the thing that would have failed.

Measured, with the workflow's own regex under real grep -E

PRE-FIX (noncode only):
  docs/security/asvs-apply-cells.py      -> NON-CODE (suite skipped)
  docs/benchmarks/.../b5_microbench.py   -> NON-CODE (suite skipped)
POST-FIX (alwayscode checked first):
  docs/security/asvs-apply-cells.py      -> code
  docs/SECURITY.md                       -> NON-CODE (still short-circuits)
  .gitignore                             -> code (via the noncode branch, #327)

That first file is the tool that writes the ASVS record of record and can silently un-close an owner-closed cell — exempt from lint, mypy and the entire suite by virtue of its directory. Two mypy errors had been sitting in it since it was written; they could not have survived a single check. That's the corroboration the exemption was real.

Two things make this worse than a missing test

The comment and the regex disagree, and the comment is what people read. ci.yml states the intent in as many words — "any *.py … counts as CODE and runs the full suite" — and the regex does not implement that sentence. An auditor reads the comment, agrees, and moves on.

The precedent sits four lines above the defect. #327 fixed exactly this shape for .gitignore and wrote the lesson down in place. The identical defect for docs/**/*.py was in the regex immediately below that paragraph. Instance fixed, class left open, with the reasoning that would have closed it preserved alongside. Hence an extension rule rather than another one-path exception.

The fix, and what it preserves

alwayscode='\.(py|ps1|sh|ts|js|yml|yaml|toml|lock|cfg|ini)$', evaluated before the noncode allowlist. The docs-only optimisation is deliberately kept for actual documents — simply deleting ^docs/ would run the full suite on every prose edit, which is the cost the short-circuit exists to avoid.

The test drives the detector, and reads its regexes out of ci.yml

A test carrying its own copy of the pattern passes forever while the workflow drifts underneath it — this defect, one level up.

It asserts the regression in both directions in a single test: the pre-fix logic classifies docs/x.py as non-code and the post-fix logic does not. Asserting only the new behaviour cannot distinguish a fixed detector from a deleted one — return True passes that. A negative control is included so a regex that accidentally matched everything cannot make every assertion pass vacuously.

Blast radius: 2 files in this repo (benchmark scripts, low risk), 3 in the vault including the writer above.

Class escalated from my instance by the parallel asvs-tracking-rework session, which measured both repos and identified the #327 precedent.