Splits the publish job out of .gitea/workflows/ci.yml into a standalone .gitea/workflows/publish.yml triggered only on push to main, and documents the publish/release model.
Motivated by phase-8 code review WR-01 + the branch-protection rule now on main (direct push blocked, force push blocked, required checks = CI / fast-checks/api/harness (pull_request)).
Why
publish lived in ci.yml guarded by if: github.event_name == 'push'. Because ci.yml also triggers on pull_request, Gitea registered an orphaned CI / publish (pull_request) status that sat pending forever on every PR (skipped jobs don't resolve their status). Moving publish to its own push-only workflow stops that orphan from ever being created.
Changes
.gitea/workflows/publish.yml (new) — name: Publish, on: push: branches: [main] only, MILESTONE: v1.1 env, the publish job + four steps moved verbatim (comments preserved). Redundant event-guard if: dropped.
.gitea/workflows/ci.yml — removed the publish job, the push: trigger, and the workflow-level MILESTONE. name: CI and the fast-checks/api/harness job ids are unchanged.
README.md — new "Publishing / Releases" section (when/what/secret/safety-gate/MILESTONE bump).
Safety
Branch-protection contexts are unchanged — name: CI and the three job ids are held stable, so the required checks on main stay valid.
No CI behavior change beyond the split. Both YAML files validated with yq.
This PR itself runs the three CI jobs with no pending publish status.
## What
Splits the `publish` job out of `.gitea/workflows/ci.yml` into a standalone `.gitea/workflows/publish.yml` triggered only on push to `main`, and documents the publish/release model.
Motivated by phase-8 code review **WR-01** + the branch-protection rule now on `main` (direct push blocked, force push blocked, required checks = `CI / fast-checks/api/harness (pull_request)`).
## Why
`publish` lived in `ci.yml` guarded by `if: github.event_name == 'push'`. Because `ci.yml` also triggers on `pull_request`, Gitea registered an orphaned `CI / publish (pull_request)` status that sat **pending forever** on every PR (skipped jobs don't resolve their status). Moving publish to its own push-only workflow stops that orphan from ever being created.
## Changes
- **`.gitea/workflows/publish.yml`** (new) — `name: Publish`, `on: push: branches: [main]` only, `MILESTONE: v1.1` env, the publish job + four steps moved verbatim (comments preserved). Redundant event-guard `if:` dropped.
- **`.gitea/workflows/ci.yml`** — removed the `publish` job, the `push:` trigger, and the workflow-level `MILESTONE`. `name: CI` and the `fast-checks`/`api`/`harness` job ids are unchanged.
- **`README.md`** — new "Publishing / Releases" section (when/what/secret/safety-gate/MILESTONE bump).
## Safety
- Branch-protection contexts are **unchanged** — `name: CI` and the three job ids are held stable, so the required checks on `main` stay valid.
- No CI behavior change beyond the split. Both YAML files validated with `yq`.
- This PR itself runs the three CI jobs with **no** pending publish status.
- Create .gitea/workflows/publish.yml (push-to-main only, name=Publish)
- Strip publish job, push trigger, and MILESTONE env from ci.yml
- Eliminates orphaned CI / publish (pull_request) status on PRs
- Preserves all three required PR status contexts unchanged
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
Splits the
publishjob out of.gitea/workflows/ci.ymlinto a standalone.gitea/workflows/publish.ymltriggered only on push tomain, and documents the publish/release model.Motivated by phase-8 code review WR-01 + the branch-protection rule now on
main(direct push blocked, force push blocked, required checks =CI / fast-checks/api/harness (pull_request)).Why
publishlived inci.ymlguarded byif: github.event_name == 'push'. Becauseci.ymlalso triggers onpull_request, Gitea registered an orphanedCI / publish (pull_request)status that sat pending forever on every PR (skipped jobs don't resolve their status). Moving publish to its own push-only workflow stops that orphan from ever being created.Changes
.gitea/workflows/publish.yml(new) —name: Publish,on: push: branches: [main]only,MILESTONE: v1.1env, the publish job + four steps moved verbatim (comments preserved). Redundant event-guardif:dropped..gitea/workflows/ci.yml— removed thepublishjob, thepush:trigger, and the workflow-levelMILESTONE.name: CIand thefast-checks/api/harnessjob ids are unchanged.README.md— new "Publishing / Releases" section (when/what/secret/safety-gate/MILESTONE bump).Safety
name: CIand the three job ids are held stable, so the required checks onmainstay valid.yq.