From c5dd83d87df27275f4c3b58e765e1028bd2b4607 Mon Sep 17 00:00:00 2001 From: Wynne Pirini Date: Thu, 5 Nov 2026 07:24:14 +1300 Subject: [PATCH] ci(docker): only upload standalone binaries when a release will use them Since #112 the build job exports and packages the standalone binaries on every run, then uploads them as an artifact. Only the release job consumes that artifact, and it runs on a version tag or a dry-run dispatch, so every PR and branch push currently stores an archive nobody downloads. Gate just the upload. Export and packaging stay ungated on purpose: they are what proves the `standalone` stage still builds, and moving that check to release time is exactly the trap of a gate that cannot fail until it matters. The condition deliberately mirrors the release job's, including the workflow_dispatch dry run. A bare `startsWith(github.ref, 'refs/tags/v')` would make the dry-run rehearsal fail at download-artifact, which is the one path that exists to prove the release sequence works without cutting a tag. --- .github/workflows/docker-publish.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index dcf3edbe..52beaf75 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -128,7 +128,16 @@ jobs: cd dist/release sha256sum ./*.tar.gz > checksums.txt + # Only upload when a release job will consume the artifact. Exporting and + # packaging above stay ungated on purpose: they prove the `standalone` stage + # still builds on every PR, so a break is caught there rather than during a + # release. This step is the one that costs storage for nothing on PRs and + # branch pushes. + # + # The condition must match the `release` job exactly, including the + # workflow_dispatch dry run, or the rehearsal finds no artifact to download. - name: Upload standalone binaries + if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.dry_run) uses: actions/upload-artifact@v7 with: name: standalone-binaries