From 6990cc054473af4e8cb8ac98a52982baf9ce99d5 Mon Sep 17 00:00:00 2001 From: SASAGAWA Kiyoshi Date: Wed, 14 Oct 2026 20:47:13 +0900 Subject: [PATCH] ci: gate image build on CI success build-images.yml now calls ci.yml via workflow_call and the build job needs it, so a failing commit no longer publishes :dev (which keel auto-deploys). dev/main are excluded from ci.yml's push trigger to avoid running CI twice. Closes #288 Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv --- .github/workflows/build-images.yml | 8 ++++++++ .github/workflows/ci.yml | 4 ++++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml index fb198cc9..5f30c102 100644 --- a/.github/workflows/build-images.yml +++ b/.github/workflows/build-images.yml @@ -10,6 +10,10 @@ name: Build & Push Images # Note: we intentionally do NOT publish a moving `:latest` tag. The cluster # tracks the explicit `:dev` tag, and avoiding `:latest` sidesteps the tag # resolution ambiguity that previously affected keel on the ikaskey instance. +# +# CI gate: images are only built after ci.yml passes for the same commit. +# keel auto-deploys :dev, so publishing an image from a failing commit would +# ship it to production (#288). on: push: @@ -25,8 +29,12 @@ env: IMAGE_NAMESPACE: love-rox jobs: + ci: + uses: ./.github/workflows/ci.yml + build: name: Build ${{ matrix.component }} + needs: ci runs-on: ubuntu-latest permissions: contents: read diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0fc73951..a2dc1736 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,10 @@ on: push: branches-ignore: - 'dependabot/**' + # dev / main run CI via build-images.yml (workflow_call), which gates + # image publishing on the result. Skip here to avoid running CI twice. + - dev + - main pull_request: branches: [main, dev] workflow_call: