D-OZT-01: Safety gate is branch protection on main (not needs:) — publish.yml runs in a separate workflow invocation from ci.yml PR jobs
D-OZT-02: README is the documentation home for the release model (not a separate docs/RELEASE.md) — consistent with this project's single-maintainer pattern
D-OZT-03: Dropped the redundant if: github.event_name == 'push' guard — push-to-main trigger in publish.yml fully replaces it
duration
completed
tasks_completed
tasks_total
files_changed
~5 minutes
2026-06-11
2
2
3
Quick Task 260611-ozt: Split publish job into standalone Gitea workflow
Split the publish job out of .gitea/workflows/ci.yml into a new standalone .gitea/workflows/publish.yml. Mechanical refactor — no CI behavior change beyond the split.
What Changed
.gitea/workflows/publish.yml (created)
New standalone push-only workflow:
name: Publish, on: push: branches: [main] only
Workflow-level MILESTONE: v1.1 env (moved from ci.yml)
Single publish job with all four steps verbatim from ci.yml: checkout, compute image tags, docker login, build+push, docker logout
All inline comments preserved including load-bearing rationale (Pitfall 13 PAT-via-stdin, D-PAT-NAMING REGISTRY_PAT naming, T-08-10 build-from-repo-root, D-04 two-tag scheme)
Dropped the redundant if: github.event_name == 'push' && github.ref == 'refs/heads/main' guard — push-to-main trigger is sufficient
.gitea/workflows/ci.yml (modified)
Removed publish: job (was lines 314-362)
Removed push: branches: [main] trigger — now pull_request only
Removed workflow-level env: MILESTONE: v1.1 block (was only referenced by the publish job)
name: CI unchanged
Job ids fast-checks, api, harness unchanged
if: github.event_name == 'pull_request' guards on all three jobs unchanged
README.md (modified)
Added "Publishing / Releases" section between "Deployment" and "License" covering:
Auto-trigger on push to main (PR merge)
Image name and two-tag scheme (:latest + :-)
REGISTRY_PAT secret requirement and naming rationale
Branch-protection safety gate (why no needs: in publish.yml)
How to bump the MILESTONE tag
Why This Matters
ci.yml's on: previously included push: so Gitea registered a CI / publish (pull_request) commit status on every PR that sat pending forever — skipped jobs never resolve their status in Gitea Actions. Moving publish to a push-only publish.yml stops this orphaned status from ever being created, keeping PR status views clean and the branch-protection required-checks list unambiguous.
Commits
Hash
Message
6efc062
chore(260611-ozt): split publish job into standalone publish.yml
0c9139b
docs(260611-ozt): document release model in README Publishing/Releases section
YAML Verification
Both workflow files validated with docker run --rm -i mikefarah/yq:4 e '.' -:
.gitea/workflows/publish.yml: VALID
.gitea/workflows/ci.yml: VALID
Deviations from Plan
None — plan executed exactly as written. The header comment block in publish.yml was created in Task 1 (the plan referenced it as "see Task 2" but it is part of the publish.yml file created in Task 1; both tasks committed separately as planned).
Self-Check: PASSED
.gitea/workflows/publish.yml exists with name: Publish, push: trigger, REGISTRY_PAT, MILESTONE: v1.1, no redundant guard
.gitea/workflows/ci.yml has no publish: job, no push: trigger, no MILESTONE, retains name: CI and three PR job ids
README.md has Publishing/Releases section with all six required elements