ci: close change-detection gaps found in review

Four changes, three of them gaps in the filters added by the previous commit.

Go tests execute db/migrations/*.sql for real: persistence_suite_test.go calls
db.Init, which runs goose against an in-memory database. `make migration-sql`
produces a .sql-only diff, and six such commits exist in history, so those PRs
would have run zero Go tests. Added ^db/migrations/ to the Go filter.

validate-translations.sh reads ui/src/i18n/en.json as its reference, not
resources/i18n/en.json, which does not exist. A commit that only removes an
English key (dd4802c0c is one) would have skipped the only check that reports
the orphaned keys left in all 36 translations.

The coverage-artifact probe was unpaginated. A full Go pipeline run produces
exactly 30 artifacts, the API default page size, and octocov-pr sorts to index
27 because the test jobs finish first. Run 33503006884 already produced 33 and
pushed all three coverage artifacts off page one. Server-side ?name= filtering
has no count ceiling.

The script also now fails closed if the base ref cannot be resolved. The fetch
itself stays non-fatal: actions/checkout already created the ref, so a failed
refresh is harmless, and making it fatal would turn a transient blip into a red
pipeline.

Also adds workflow_dispatch, so a manual run is possible and gets every flag.

.github/workflows/coverage-on-pr.yml

@@ -21,8 +21,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/${{ github.event.workflow_run.id }}/artifacts" \
-            --jq '[.artifacts[] | select(.name == "octocov-pr")] | length')
+          count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/${{ github.event.workflow_run.id }}/artifacts?name=octocov-pr" \
+            --jq '.total_count')
           echo "count=$count" >> "$GITHUB_OUTPUT"
 
       # Only the config, from the base branch: this job holds a write token, so

.github/workflows/detect-changes.sh

@@ -9,8 +9,8 @@
 #   build - anything that ends up in a binary, image or package (i.e. every
 #           change except the doc-only paths in $DOC_ONLY_RE)
 #
-# Only pull requests are narrowed. Master pushes and tags always get every flag,
-# so a release can never be built from a partially validated tree.
+# Only pull requests are narrowed. Master pushes, tags and manual runs always get
+# every flag, so a release can never be built from a partially validated tree.
 #
 # Flags gate STEPS, not jobs: a job-level skip propagates through the needs
 # chain (actions/runner#491) and would take the release jobs down with it.
@@ -20,9 +20,9 @@
 set -uo pipefail
 export LC_ALL=C
 
-GO_RE='(\.go$|(^|/)go\.(mod|sum)$|^Makefile$|^\.golangci\.yml$|^resources/)'
+GO_RE='(\.go$|(^|/)go\.(mod|sum)$|^Makefile$|^\.golangci\.yml$|^resources/|^db/migrations/)'
 JS_RE='^ui/'
-I18N_RE='(^resources/i18n/|^\.github/workflows/validate-translations\.sh$)'
+I18N_RE='(^resources/i18n/|^ui/src/i18n/en\.json$|^\.github/workflows/validate-translations\.sh$)'
 DOC_ONLY_RE='(\.md$|^LICENSE$|^\.git-blame-ignore-revs$|^\.gitignore$|^\.devcontainer/)'
 
 emit() { printf '%s=%s\n' "$1" "$2" | tee -a "${GITHUB_OUTPUT:-/dev/null}"; }
@@ -34,7 +34,13 @@ if [ "${GITHUB_EVENT_NAME:-}" != "pull_request" ]; then
 fi
 
 BASE_REF="${BASE_REF:-master}"
-git fetch --no-tags --quiet origin "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}"
+git fetch --no-tags --quiet origin "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}" || true
+# Guard the diff, not the fetch: checkout already created the ref, so a failed
+# refresh is harmless, but an unresolvable ref would emit every flag as false.
+if ! git rev-parse --verify --quiet "origin/${BASE_REF}" >/dev/null; then
+  printf '::error::Cannot resolve origin/%s. In CI, check out with fetch-depth: 0.\n' "$BASE_REF" >&2
+  exit 1
+fi
 
 files="$(git diff --name-only "origin/${BASE_REF}...HEAD")"
 echo "Changed files:"

.github/workflows/pipeline.yml

@@ -8,6 +8,7 @@ on:
   pull_request:
     branches:
       - master
+  workflow_dispatch:
 
 concurrency:
   group: ${{ startsWith(github.ref, 'refs/tags/v') && 'tag' || 'branch' }}-${{ github.ref }}