The release workflow hashes everything that goes into the image build and skips
CI and the build when the registry already has an image for that hash, so a docs
or tooling change, or a version tag, only re-points the tags. ci.yml no longer
runs on main by push: release.yml calls it when a build is needed, and running
both repeated the same suite on the same commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Next standalone build in three stages, non-root, healthchecked. next 15.5.28
(image-optimiser RCE) with postcss pinned past the copy bundled by next.
release.yml publishes linux/arm64 to the Gitea registry. The book/ directory is
a repository of its own and stays out of the build context.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Linux-only runner, so the Windows and macOS legs and GitHub's audit action are
gone. The Rust toolchain, cargo registry and target directories live on the
runner's persistent toolcache volume. release.yml stays under .github and is
not run by Gitea.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>