From 0db4d8e682d4960fc6acd93923ec831ae4c497cd Mon Sep 17 00:00:00 2001 From: NeskireDK <10115530+NeskireDK@users.noreply.github.com> Date: Thu, 13 Aug 2026 08:38:34 +0200 Subject: [PATCH] CI: publish :latest from the arik branch only MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The build job had no branch condition and tagged :latest on every run. A workflow_dispatch on a work branch would therefore publish that branch to ghcr.io, and Watchtower would deploy it to production the same night. With the guard, a dispatch on a work branch runs the test job alone — crystal spec plus the warning-clean build — on a GitHub runner. That is how this branch gets type-checked: the compiler needs more memory than LXC 108 has. Co-Authored-By: Claude Opus 5 --- .github/workflows/build-arik-container.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/build-arik-container.yml b/.github/workflows/build-arik-container.yml index 9c3a8a33c..62588b36f 100644 --- a/.github/workflows/build-arik-container.yml +++ b/.github/workflows/build-arik-container.yml @@ -44,6 +44,10 @@ jobs: build: needs: test + # Only the arik branch publishes :latest — production pulls that tag through + # Watchtower. A dispatch on any other branch runs the test job alone, which + # is how a work branch gets type-checked without shipping itself. + if: github.ref == 'refs/heads/arik' runs-on: ubuntu-latest permissions: contents: read