The release workflow hashes everything that goes into the image build and skips
CI and the build when the registry already has an image for that hash, so a docs
or tooling change, or a version tag, only re-points the tags. ci.yml no longer
runs on main by push: release.yml calls it when a build is needed, and running
both repeated the same suite on the same commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Next standalone build in three stages, non-root, healthchecked. next 15.5.28
(image-optimiser RCE) with postcss pinned past the copy bundled by next.
release.yml publishes linux/arm64 to the Gitea registry. The book/ directory is
a repository of its own and stays out of the build context.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>