CI: publish :latest from the arik branch only

The build job had no branch condition and tagged :latest on every run.
A workflow_dispatch on a work branch would therefore publish that branch
to ghcr.io, and Watchtower would deploy it to production the same night.

With the guard, a dispatch on a work branch runs the test job alone —
crystal spec plus the warning-clean build — on a GitHub runner. That is
how this branch gets type-checked: the compiler needs more memory than
LXC 108 has.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
NeskireDK 2026-08-13 08:38:34 +02:00
parent 77eee92465
commit 0db4d8e682

View File

@ -44,6 +44,10 @@ jobs:
build:
needs: test
# Only the arik branch publishes :latest — production pulls that tag through
# Watchtower. A dispatch on any other branch runs the test job alone, which
# is how a work branch gets type-checked without shipping itself.
if: github.ref == 'refs/heads/arik'
runs-on: ubuntu-latest
permissions:
contents: read