ci: release only after successful Gitea CI

.github/workflows/ci.yml

@@ -21,6 +21,34 @@ jobs:
       - run: PYTHONPATH=app pytest -q
 
   docker-image:
+    runs-on: ubuntu-latest
+    permissions:
+      code: read
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build Docker image without publishing
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ./app/Dockerfile
+          platforms: linux/amd64
+          push: false
+          load: false
+          tags: relaytv-ci:${{ gitea.sha }}
+          build-args: |
+            RELAYTV_IMAGE_SOURCE=https://git.relaytv.app/${{ gitea.repository }}
+            RELAYTV_IMAGE_REVISION=${{ gitea.sha }}
+            RELAYTV_IMAGE_VERSION=${{ gitea.ref_name }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  publish-main:
+    needs: [test, docker-image]
+    if: gitea.event_name == 'push' && gitea.ref_name == 'main'
     runs-on: ubuntu-latest
     permissions:
       code: read
@@ -34,20 +62,19 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Gitea container registry
-        if: gitea.event_name != 'pull_request' && gitea.ref_name == 'main'
         uses: docker/login-action@v4
         with:
           registry: git.relaytv.app
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
-      - name: Build and optionally publish Docker image
+      - name: Publish main Docker image
         uses: docker/build-push-action@v7
         with:
           context: .
           file: ./app/Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: ${{ gitea.event_name != 'pull_request' && gitea.ref_name == 'main' }}
+          push: true
           load: false
           tags: git.relaytv.app/relaytv/relaytv:main
           build-args: |

.github/workflows/release.yml

@@ -1,7 +1,9 @@
 name: release
 
 on:
-  push:
+  workflow_run:
+    workflows: [ci]
+    types: [completed]
     branches: [main]
 
 permissions:
@@ -14,11 +16,13 @@ concurrency:
 
 jobs:
   release:
+    if: gitea.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          ref: ${{ gitea.event.workflow_run.head_sha }}
           token: ${{ secrets.RELEASE_TOKEN }}
 
       - uses: actions/setup-python@v6
@@ -26,7 +30,11 @@ jobs:
           python-version: '3.12'
 
       - name: Configure release identity
+        env:
+          RELEASE_SHA: ${{ gitea.event.workflow_run.head_sha }}
         run: |
+          git switch -C main "$RELEASE_SHA"
+          git branch --set-upstream-to=origin/main main
           git config user.name "relaytv-release-bot"
           git config user.email "release-bot@relaytv.app"
 

docs/RELEASE.md

@@ -56,8 +56,9 @@ docker inspect git.relaytv.app/relaytv/relaytv:latest
 
 ## Automated Release Flow
 
-RelayTV uses Python Semantic Release on pushes to `main`. Normal feature and
-fix changes should land through pull requests with Conventional Commit titles:
+RelayTV runs Python Semantic Release only after the `ci` workflow completes
+successfully on `main`. Normal feature and fix changes should land through pull
+requests with Conventional Commit titles:
 
 ```text
 feat: add Jellyfin pairing status

tests/test_smoke.py

@@ -842,6 +842,9 @@ def test_main_ci_build_publishes_main_tag_not_release_latest() -> None:
 
     assert "git.relaytv.app/relaytv/relaytv:main" in text
     assert "git.relaytv.app/relaytv/relaytv:latest" not in text
+    assert "needs: [test, docker-image]" in text
+    assert "push: false" in text
+    assert "push: true" in text
 
 
 def test_release_image_traceability_metadata_is_documented() -> None:
@@ -882,6 +885,8 @@ def test_gitea_semantic_release_automation_is_configured() -> None:
     assert 'version_toml = ["pyproject.toml:project.version"]' in pyproject
     assert "python-semantic-release==10.6.1" in workflow
     assert "semantic-release version --push --vcs-release" in workflow
+    assert "workflow_run:" in workflow
+    assert "gitea.event.workflow_run.conclusion == 'success'" in workflow
     assert "token: ${{ secrets.RELEASE_TOKEN }}" in workflow
     assert "git.relaytv.app/relaytv/relaytv:${{ steps.release.outputs.tag }}" in workflow
     assert "git.relaytv.app/relaytv/relaytv:latest" in workflow