From 1b249dbf8ae9d214fefb77077546b6675a3a07bc Mon Sep 17 00:00:00 2001
From: Wynne Pirini <wynnepirini@gmail.com>
Date: Tue, 3 Nov 2026 13:07:26 +1300
Subject: [PATCH] fix(ci): key the arm64 smoke job on "published an image", not
 "is a PR"

The dry run added in #214 failed arm64-smoke, and the failure was correct:

  IMAGE_REF: ghcr.io/calnode/calnode@
  ##[error]build produced no digest, so there is nothing to verify

A dry-run dispatch builds without pushing, so it has no digest to pull, but the
job's conditions were written as "pull unless this is a pull request". A
dispatch is not a pull request, so it took the pull path with an empty digest.

After #214 the only event that publishes an image is a push (branch or tag), so
gate on that instead: pull the published digest on a push, and build natively
for anything else (pull request or dry-run dispatch). The resolver that picks
the ref is switched the same way.

This is the dry run doing its job: it found a bug in the release path's
assumptions before a tag could.
---
 .github/workflows/docker-publish.yml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 52686864..dcf3edbe 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -65,7 +65,7 @@ jobs:
       - uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        if: github.event_name != 'pull_request'
+        if: github.event_name == 'push'
         uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
@@ -165,7 +165,7 @@ jobs:
           test "$(uname -m)" = "aarch64"
 
       - name: Pull the image this build just published
-        if: github.event_name != 'pull_request'
+        if: github.event_name == 'push'
         env:
           IMAGE_REF: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}"
         run: |
@@ -176,18 +176,20 @@ jobs:
           fi
           docker pull "$IMAGE_REF"
 
-      - name: Build for arm64 natively (pull requests only)
-        if: github.event_name == 'pull_request'
+      - name: Build for arm64 natively (anything that did not publish an image)
+        if: github.event_name != 'push'
         run: docker build --platform linux/arm64 -t calnode-pr:arm64 .
 
       - name: Resolve the image under test
         id: img
         run: |
           set -euo pipefail
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            echo "ref=calnode-pr:arm64" >> "$GITHUB_OUTPUT"
-          else
+          # A push published an image, so verify that exact digest. Anything else
+          # (pull request, dry-run dispatch) built locally and is verified as-is.
+          if [ "${{ github.event_name }}" = "push" ]; then
             echo "ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "ref=calnode-pr:arm64" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Confirm the image is arm64