From 8c127cc45a34210ad57c9843b362bdac07c0b8c5 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Fri, 12 Dec 2025 22:17:32 +0100
Subject: [PATCH] ci: fix container publish workflow to run on version tag
 pushes

Switch publish-containers workflow from workflow_run to direct v* tag triggers,
remove obsolete workflow_run logic, simplify version detection via GITHUB_REF_NAME,
and keep stable-tag detection aligned with the stable ref.

https://chatgpt.com/share/693c836b-0b00-800f-9536-9e273abd0fb5
---
 .github/workflows/publish-containers.yml | 25 +++++++++---------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/publish-containers.yml b/.github/workflows/publish-containers.yml
index ac289e4..15cd3c7 100644
--- a/.github/workflows/publish-containers.yml
+++ b/.github/workflows/publish-containers.yml
@@ -1,13 +1,12 @@
 name: Publish container images (GHCR)
 
 on:
-  workflow_run:
-    workflows: ["Mark stable commit"]
-    types: [completed]
+  push:
+    tags:
+      - "v*"
 
 jobs:
   publish:
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
 
     permissions:
@@ -21,34 +20,28 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
-      - name: Checkout workflow_run commit
-        run: |
-          set -euo pipefail
-          git checkout -f "${{ github.event.workflow_run.head_sha }}"
-
       - name: Compute version and stable flag
         id: info
         run: |
           set -euo pipefail
 
           SHA="$(git rev-parse HEAD)"
-          V_TAG="$(git tag --points-at "${SHA}" --list 'v*' | sort -V | tail -n1)"
-          [[ -n "$V_TAG" ]] || { echo "No version tag found"; exit 1; }
-
-          VERSION="${V_TAG#v}"
+          VERSION="${GITHUB_REF_NAME#v}"
 
           STABLE_SHA="$(git rev-parse -q --verify refs/tags/stable^{commit} 2>/dev/null || true)"
           IS_STABLE=false
-          [[ "$STABLE_SHA" == "$SHA" ]] && IS_STABLE=true
+          [[ -n "${STABLE_SHA}" && "${STABLE_SHA}" == "${SHA}" ]] && IS_STABLE=true
 
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "is_stable=${IS_STABLE}" >> "$GITHUB_OUTPUT"
 
-      - uses: docker/setup-buildx-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
         with:
           use: true
 
-      - uses: docker/login-action@v3
+      - name: Login to GHCR
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}