From 2b1bdbd3d2c9601cdaedec0c9fc8aa8b9e1fb213 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Mon, 20 Apr 2026 22:08:07 +0300
Subject: [PATCH] Split CI and publish workflows

This supersedes 7d183b9 ("Run CI for pull requests"), which mixed validation and publishing in one workflow and regressed docker-manifest by dropping the package-write permission it needs to publish the manifest.

Split the workflows so CI handles pull requests, branch pushes, tags, and manual runs, while publishing stays focused on Docker delivery with the manifest permission fixed explicitly at the job level.
---
 .github/workflows/ci.yml                      | 26 +++++++++++++++++++
 .../workflows/{workflow.yml => publish.yml}   | 24 ++++-------------
 2 files changed, 31 insertions(+), 19 deletions(-)
 create mode 100644 .github/workflows/ci.yml
 rename .github/workflows/{workflow.yml => publish.yml} (81%)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..59545ec
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,26 @@
+name: CI
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [ "main" ]
+  push:
+    branches:
+      - "**"
+    tags: [ "v*" ]
+permissions:
+  contents: read
+  pull-requests: read
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  test-and-clippy:
+    name: Unit testing and linting
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@1.93.0
+      - name: Install SQLite3
+        run: sudo apt-get update && sudo apt-get install -y libsqlite3-dev
+      - run: cargo test --all-features
+      - run: cargo clippy
diff --git a/.github/workflows/workflow.yml b/.github/workflows/publish.yml
similarity index 81%
rename from .github/workflows/workflow.yml
rename to .github/workflows/publish.yml
index 448bee4..bfa8836 100644
--- a/.github/workflows/workflow.yml
+++ b/.github/workflows/publish.yml
@@ -1,30 +1,15 @@
-name: CI
+name: Publish
 on:
-  pull_request:
-    branches: [ "main" ]
   push:
     branches: [ "main" ]
     tags: [ "v*" ]
 permissions:
   contents: read
-  pull-requests: read
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: publish-${{ github.ref }}
   cancel-in-progress: false
 jobs:
-  test-and-clippy:
-    name: Unit testing and linting
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@1.93.0
-      - name: Install SQLite3
-        run: sudo apt-get update && sudo apt-get install -y libsqlite3-dev
-      - run: cargo test --all-features
-      - run: cargo clippy
-
   docker-clean-metadata:
-    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     outputs:
       json: ${{ steps.meta.outputs.json }}
@@ -40,7 +25,6 @@ jobs:
             type=semver,pattern={{raw}}
 
   docker-build:
-    if: github.event_name == 'push'
     permissions:
       contents: read
       packages: write
@@ -86,7 +70,9 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
   docker-manifest:
-    if: github.event_name == 'push'
+    permissions:
+      contents: read
+      packages: write
     needs:
       - docker-build
       - docker-clean-metadata