The build job had no branch condition and tagged :latest on every run.
A workflow_dispatch on a work branch would therefore publish that branch
to ghcr.io, and Watchtower would deploy it to production the same night.
With the guard, a dispatch on a work branch runs the test job alone —
crystal spec plus the warning-clean build — on a GitHub runner. That is
how this branch gets type-checked: the compiler needs more memory than
LXC 108 has.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Update mocks submodule to use the upstream iv-org repository
(https://github.com/iv-org/mocks) instead of the inaccessible
NeskireDK fork path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Remove submodules: true from actions/checkout since the mocks
submodule is not accessible and not needed for the build.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gate first: crystal spec + format-strict build on 1.20.3 (mirrors
upstream ci.yml). Then a linux/amd64 image build pushed as
ghcr.io/neskiredk/invidious:latest + :sha-<commit>. No expiry label.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
