fix(ci): skip cert-bot publish loop and ignore conformance-only pushes

- Gate mint/publish on the real GitHub App actor (intentproof-cert-bot[bot]),
  not github-actions[bot], so follow-up commits from the app do not re-run publish.
- On push to main, ignore paths that only update repo-root conformance JSON so
  main does not churn after artifact commits (fewer stale PR bases).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Nathan Gillett

.github/workflows/ci.yml

@@ -3,6 +3,9 @@ name: CI
 on:
   push:
     branches: [main, master]
+    paths-ignore:
+      - "conformance-certificate.json"
+      - "conformance-report.json"
   pull_request:
 
 concurrency:
@@ -139,14 +142,14 @@ jobs:
 
       - name: Mint cert-bot installation token
         id: cert_bot_token
-        if: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master') && github.actor != 'github-actions[bot]' }}
+        if: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master') && github.actor != 'intentproof-cert-bot[bot]' && github.actor != 'github-actions[bot]' }}
         uses: actions/create-github-app-token@v1
         with:
           app-id: ${{ vars.INTENTPROOF_CERT_BOT_ID }}
           private-key: ${{ secrets.INTENTPROOF_CERT_BOT_PRIVATE_KEY }}
 
       - name: Publish conformance certificate and report at repo root
-        if: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master') && github.actor != 'github-actions[bot]' }}
+        if: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master') && github.actor != 'intentproof-cert-bot[bot]' && github.actor != 'github-actions[bot]' }}
         env:
           INTENTPROOF_CERT_BOT_TOKEN: ${{ steps.cert_bot_token.outputs.token }}
         run: |