Drop the pull_request trigger (the branch push already validates the commit),
drop the second npm run build from the lint job (the image build compiles it),
and build the image on arm64 after the cheap checks pass. The CI publishes it
as inputs-<hash>, so the merge to main only re-tags it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
CHANGELOG.md in Portuguese, from the project history. The release job builds its
notes from the matching section. The new files are excluded from the image hash,
so the published image is reused. README points at the Gitea repository.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The release workflow hashes everything that goes into the image build and skips
CI and the build when the registry already has an image for that hash, so a docs
or tooling change, or a version tag, only re-points the tags. ci.yml no longer
runs on main by push: release.yml calls it when a build is needed, and running
both repeated the same suite on the same commit.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Next standalone build in three stages, non-root, healthchecked. next 15.5.28
(image-optimiser RCE) with postcss pinned past the copy bundled by next.
release.yml publishes linux/arm64 to the Gitea registry. The book/ directory is
a repository of its own and stays out of the build context.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Linux-only runner, so the Windows and macOS legs and GitHub's audit action are
gone. The Rust toolchain, cargo registry and target directories live on the
runner's persistent toolcache volume. release.yml stays under .github and is
not run by Gitea.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
