Harden CI and gate Docker releases on successful checks

.github/workflows/docker.yml

@@ -1,25 +1,38 @@
 name: Docker
 
 on:
-  push:
-    branches:
-      - main
-      - master
-    tags:
-      - 'v*'
+  pull_request:
     paths:
       - 'VERSION'
       - 'Dockerfile'
+      - '.dockerignore'
       - 'src/**'
       - 'web/**'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - 'migrations/**'
       - 'build.rs'
+      - '.github/workflows/docker.yml'
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
+    branches:
+      - main
+      - master
+  push:
+    tags:
+      - 'v*'
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number ||
+      github.event.workflow_run.head_branch ||
+      github.ref
+    }}
   cancel-in-progress: true
 
 env:
@@ -32,12 +45,56 @@ permissions:
 
 jobs:
   docker:
+    if: >-
+      ${{
+        github.event_name == 'pull_request' ||
+        github.event_name == 'workflow_dispatch' ||
+        github.event_name == 'push' ||
+        (
+          github.event_name == 'workflow_run' &&
+          github.event.workflow_run.conclusion == 'success' &&
+          github.event.workflow_run.event == 'push'
+        )
+      }}
     runs-on: ubuntu-latest
+    timeout-minutes: 90
     steps:
+      - name: Plan build mode
+        id: plan
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "workflow_run" ]]; then
+            {
+              echo "checkout_ref=${{ github.event.workflow_run.head_sha }}"
+              echo "push=true"
+              echo "platforms=linux/amd64,linux/arm64"
+            } >> "$GITHUB_OUTPUT"
+          elif [[ "${{ github.event_name }}" == "push" ]]; then
+            {
+              echo "checkout_ref=${{ github.sha }}"
+              echo "push=true"
+              echo "platforms=linux/amd64,linux/arm64"
+            } >> "$GITHUB_OUTPUT"
+          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            {
+              echo "checkout_ref=${{ github.sha }}"
+              echo "push=false"
+              echo "platforms=linux/amd64"
+            } >> "$GITHUB_OUTPUT"
+          else
+            {
+              echo "checkout_ref=${{ github.sha }}"
+              echo "push=false"
+              echo "platforms=linux/amd64"
+            } >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          ref: ${{ steps.plan.outputs.checkout_ref }}
 
       - name: Read VERSION file
         id: version
@@ -53,10 +110,11 @@ jobs:
         with:
           images: ${{ steps.image.outputs.name }}
           tags: |
-            type=raw,value=${{ steps.version.outputs.version }}
-            type=raw,value=latest,enable=${{ !contains(steps.version.outputs.version, '-') }}
-            type=raw,value=edge,enable=${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' }}
-            type=sha,prefix=sha-,format=short
+            type=raw,value=pr-${{ github.event.pull_request.number }},enable=${{ github.event_name == 'pull_request' }}
+            type=raw,value=${{ steps.version.outputs.version }},enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
+            type=raw,value=latest,enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && !contains(steps.version.outputs.version, '-') }}
+            type=raw,value=edge,enable=${{ github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch' }}
+            type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'pull_request' }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -65,6 +123,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR
+        if: steps.plan.outputs.push == 'true'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -76,8 +135,8 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
+          platforms: ${{ steps.plan.outputs.platforms }}
+          push: ${{ steps.plan.outputs.push == 'true' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
@@ -91,7 +150,9 @@ jobs:
           {
             echo "### Docker Build"
             echo "**Image:** ${{ steps.image.outputs.name }}"
+            echo "**Event:** ${{ github.event_name }}"
+            echo "**Pushed:** ${{ steps.plan.outputs.push }}"
             echo "**Version:** ${{ steps.version.outputs.version }}"
-            echo "**Platforms:** linux/amd64, linux/arm64"
+            echo "**Platforms:** ${{ steps.plan.outputs.platforms }}"
             echo "**Digest:** ${{ steps.build.outputs.digest }}"
           } >> "$GITHUB_STEP_SUMMARY"