fix(ci): separate PR validation from image publishing

Validate container builds inside CI for pull requests, and publish images only after CI succeeds on main or when a release tag is pushed.

.github/workflows/ci.yml

@@ -5,6 +5,8 @@ on:
   push:
     branches:
       - main
+    tags:
+      - v*
   workflow_dispatch:
 
 permissions:
@@ -49,3 +51,26 @@ jobs:
           NODE_ENV=dry-run node ./build/stand-alone/crawl.js
           NODE_ENV=dry-run node ./build/stand-alone/search.js
           NODE_ENV=dry-run node ./build/stand-alone/serp.js
+
+  validate-container:
+    name: Validate container build
+    runs-on: ubuntu-latest
+    needs: verify
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Prepare licensed assets
+        run: node ./scripts/prepare-licensed-assets.cjs
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build container image without publishing
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: .
+          push: false

.github/workflows/image.yml

@@ -1,21 +1,12 @@
 name: Container Image
 
 on:
-  pull_request:
-    paths:
-      - Dockerfile
-      - package.json
-      - package-lock.json
-      - tsconfig.json
-      - integrity-check.cjs
-      - src/**
-      - public/**
-      - licensed/**
-      - scripts/**
-      - .github/workflows/image.yml
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
   push:
-    branches:
-      - main
     tags:
       - v*
   workflow_dispatch:
@@ -31,11 +22,20 @@ concurrency:
 jobs:
   docker:
     name: Build container image
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
+      (github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_branch == 'main')
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
 
       - name: Prepare licensed assets
         run: node ./scripts/prepare-licensed-assets.cjs