Overhaul CI, nightly, and Docker release workflows

.github/workflows/docker.yml

@@ -13,108 +13,31 @@ on:
       - 'migrations/**'
       - 'build.rs'
       - '.github/workflows/docker.yml'
-  workflow_run:
-    workflows:
-      - CI
-    types:
-      - completed
-    branches:
-      - main
-      - master
-  push:
-    tags:
-      - 'v*'
   workflow_dispatch:
 
 concurrency:
-  group: >-
-    ${{ github.workflow }}-${{
-      github.event.pull_request.number ||
-      github.event.workflow_run.head_branch ||
-      github.ref
-    }}
+  group: docker-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-
 permissions:
   contents: read
   packages: write
 
 jobs:
   docker:
-    if: >-
-      ${{
-        github.event_name == 'pull_request' ||
-        github.event_name == 'workflow_dispatch' ||
-        github.event_name == 'push' ||
-        (
-          github.event_name == 'workflow_run' &&
-          github.event.workflow_run.conclusion == 'success' &&
-          github.event.workflow_run.event == 'push'
-        )
-      }}
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - name: Plan build mode
-        id: plan
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ "${{ github.event_name }}" == "workflow_run" ]]; then
-            {
-              echo "checkout_ref=${{ github.event.workflow_run.head_sha }}"
-              echo "push=true"
-              echo "platforms=linux/amd64,linux/arm64"
-            } >> "$GITHUB_OUTPUT"
-          elif [[ "${{ github.event_name }}" == "push" ]]; then
-            {
-              echo "checkout_ref=${{ github.sha }}"
-              echo "push=true"
-              echo "platforms=linux/amd64,linux/arm64"
-            } >> "$GITHUB_OUTPUT"
-          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            {
-              echo "checkout_ref=${{ github.sha }}"
-              echo "push=false"
-              echo "platforms=linux/amd64"
-            } >> "$GITHUB_OUTPUT"
-          else
-            {
-              echo "checkout_ref=${{ github.sha }}"
-              echo "push=false"
-              echo "platforms=linux/amd64"
-            } >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
-          ref: ${{ steps.plan.outputs.checkout_ref }}
-
-      - name: Read VERSION file
-        id: version
-        run: echo "version=$(tr -d '\n\r' < VERSION)" >> "$GITHUB_OUTPUT"
 
       - name: Lowercase image name
         id: image
-        run: echo "name=$(echo '${{ env.REGISTRY }}/${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
-
-      - name: Compute tags
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ steps.image.outputs.name }}
-          tags: |
-            type=raw,value=pr-${{ github.event.pull_request.number }},enable=${{ github.event_name == 'pull_request' }}
-            type=raw,value=${{ steps.version.outputs.version }},enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
-            type=raw,value=latest,enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && !contains(steps.version.outputs.version, '-') }}
-            type=raw,value=edge,enable=${{ github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch' }}
-            type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'pull_request' }}
+        run: |
+          echo "name=$(echo 'ghcr.io/bybrooklyn/alchemist' \
+            | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -123,36 +46,32 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR
-        if: steps.plan.outputs.push == 'true'
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
-          registry: ${{ env.REGISTRY }}
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push Docker image
-        id: build
+      - name: Build (PR preview — no push)
+        if: github.event_name == 'pull_request'
         uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: ${{ steps.plan.outputs.platforms }}
-          push: ${{ steps.plan.outputs.push == 'true' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64
+          push: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
           provenance: false
 
-      - name: Write job summary
-        shell: bash
-        run: |
-          set -euo pipefail
-          {
-            echo "### Docker Build"
-            echo "**Image:** ${{ steps.image.outputs.name }}"
-            echo "**Event:** ${{ github.event_name }}"
-            echo "**Pushed:** ${{ steps.plan.outputs.push }}"
-            echo "**Version:** ${{ steps.version.outputs.version }}"
-            echo "**Platforms:** ${{ steps.plan.outputs.platforms }}"
-            echo "**Digest:** ${{ steps.build.outputs.digest }}"
-          } >> "$GITHUB_STEP_SUMMARY"
+      - name: Build and push (manual dispatch)
+        if: github.event_name == 'workflow_dispatch'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.image.outputs.name }}:dev
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: false