fix(ci): publish container images from the main CI workflow

.github/workflows/checks.yml

@@ -207,6 +207,63 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           parallel-finished: true
 
+  publish-container-image:
+    name: Build and push container image
+    runs-on: ubuntu-latest
+    needs:
+      - changes
+      - lint
+      - build-check
+      - test-units-and-cover
+      - test-integrations-and-cover
+      - post-tests
+    if: >-
+      always() && github.event_name == 'push' && github.ref == 'refs/heads/main' &&
+      needs.changes.result == 'success' &&
+      (
+        needs.changes.outputs.src != 'true' ||
+        (
+          needs.lint.result == 'success' &&
+          needs.build-check.result == 'success' &&
+          needs.test-units-and-cover.result == 'success' &&
+          needs.test-integrations-and-cover.result == 'success'
+        )
+      ) &&
+      needs.post-tests.result == 'success'
+    env:
+      REGISTRY: ghcr.io
+      IMAGE_NAME: ${{ github.repository }}
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=main
+            type=sha,prefix=sha-
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
   changeset-check:
     name: Changeset Required
     runs-on: ubuntu-latest

deploy/README.md

@@ -4,8 +4,8 @@ Minimal Docker Compose stack for running nostream in production. The relay
 container pulls a pre-built image from GHCR instead of building on the server.
 
 This guide assumes a Linux host with Docker Engine and the Compose plugin
-installed. For image publishing on merge to `main`, see
-`.github/workflows/publish-container-image.yml`.
+installed. Container images are published automatically after CI succeeds on pushes to
+`main`. See [`docs/DEPLOYMENT.md`](../docs/DEPLOYMENT.md) for the CI/CD flow.
 
 ## Prerequisites
 

docs/CI-MIGRATION.md

@@ -0,0 +1,27 @@
+# CI container publishing migration
+
+Container publishing is now part of `.github/workflows/checks.yml`.
+
+## What changed
+
+The standalone `publish-container-image.yml` workflow, which listened for a
+completed `workflow_run`, was removed. `checks.yml` now contains
+`publish-container-image` as its final job.
+
+## Why
+
+Keeping publishing in the workflow that performed the checks makes its
+dependencies explicit. It avoids the timing and event-context ambiguity of a
+separate `workflow_run`, which could be triggered by an external pull-request
+run.
+
+## New behavior
+
+On successful pushes to `main`, CI runs linting, the build check, unit tests,
+integration tests, and post-test reporting before publishing the container
+image. The publish job cannot run for pull requests or manual workflow runs.
+
+## Action required
+
+None. Developers and deployment users receive the same `main` and per-commit
+container image tags automatically after CI succeeds.

docs/DEPLOYMENT.md

@@ -0,0 +1,18 @@
+# Deployment and container publishing
+
+The `ghcr.io/cameri/nostream` container image is published automatically by the
+CI Checks workflow after a successful push to `main`. The workflow publishes
+both the `main` tag and a `sha-<commit>` tag.
+
+Publishing is the final stage of the CI dependency chain:
+
+```text
+changes → lint and build-check → unit and integration tests → post-tests → publish-container-image
+```
+
+The publish job runs only for `refs/heads/main` and only when `post-tests`
+succeeds. Pull requests and manual workflow runs do not publish images.
+
+Deployment hosts can pull the `main` image as described in
+[`deploy/README.md`](../deploy/README.md). There is no separate manual image
+publishing step.

test/unit/ci/publish-container-image.spec.ts

@@ -0,0 +1,36 @@
+import { existsSync, readFileSync } from 'fs'
+import { join } from 'path'
+
+import chai from 'chai'
+import { load } from 'js-yaml'
+
+const { expect } = chai
+
+type Workflow = {
+  jobs: Record<string, { if?: string; needs?: string[] }>
+}
+
+describe('container image publishing workflow', () => {
+  const workflow = load(readFileSync(join(process.cwd(), '.github', 'workflows', 'checks.yml'), 'utf-8')) as Workflow
+
+  it('publishes only on main after all CI checks complete', () => {
+    const publish = workflow.jobs['publish-container-image']
+
+    expect(publish.needs).to.deep.equal([
+      'changes',
+      'lint',
+      'build-check',
+      'test-units-and-cover',
+      'test-integrations-and-cover',
+      'post-tests',
+    ])
+    expect(publish.if).to.include("always() && github.event_name == 'push' && github.ref == 'refs/heads/main'")
+    expect(publish.if).to.include("needs.changes.result == 'success'")
+    expect(publish.if).to.include("needs.changes.outputs.src != 'true'")
+    for (const job of publish.needs.filter((job) => !['changes', 'post-tests'].includes(job))) {
+      expect(publish.if).to.include(`needs.${job}.result == 'success'`)
+    }
+    expect(publish.if).to.include("needs.post-tests.result == 'success'")
+    expect(existsSync(join(process.cwd(), '.github', 'workflows', 'publish-container-image.yml'))).to.equal(false)
+  })
+})