(workflows) ensure we run docker builds on main only

Author: zeylos

.github/workflows/docker-publish.yml

@@ -1,6 +1,6 @@
-name: Build and Push Docker Image
+name: Build and Push Container Image
 
-on:
+"on":
   workflow_call:
     inputs:
       registry:
@@ -47,7 +47,6 @@ jobs:
           images: ${{ inputs.registry }}/${{ github.repository }}-${{ inputs.image_name }}
           tags: |
             type=ref,event=branch
-            type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
       - name: Build and push Docker image
@@ -71,11 +70,11 @@ jobs:
           package-name: messages-${{ inputs.image_name }}
           package-type: 'container'
           min-versions-to-keep: 0
-          delete-only-untagged-versions: 'true'
+          delete-only-untagged-versions: true
       - name: Container images retention
         uses: actions/delete-package-versions@v5
         with:
           package-name: messages-${{ inputs.image_name }}
           package-type: 'container'
           min-versions-to-keep: 30
-          ignore-versions: '^latest|main|(\\d+\\.\\d+(\\.\\d+)?)$'
+          ignore-versions: 'latest|main|(\\d+\\.\\d+(\\.\\d+)?)'

.github/workflows/messages-ghcr.yml

@@ -0,0 +1,72 @@
+name: Build and publish OCI images
+
+"on":
+  push:
+    branches:
+      - main
+
+jobs:
+
+  docker-publish-mta-in:
+    uses: ./.github/workflows/docker-publish.yml
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    secrets: inherit
+    with:
+      image_name: "mta-in"
+      context: "src/mta-in"
+      target: runtime-prod
+
+  docker-publish-mta-out:
+    uses: ./.github/workflows/docker-publish.yml
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    secrets: inherit
+    with:
+      image_name: "mta-out"
+      context: "src/mta-out"
+      target: runtime-prod
+
+  docker-publish-socks-proxy:
+    uses: ./.github/workflows/docker-publish.yml
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    secrets: inherit
+    with:
+      image_name: "socks-proxy"
+      context: "src/socks-proxy"
+
+  docker-publish-frontend:
+    uses: ./.github/workflows/docker-publish.yml
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    secrets: inherit
+    with:
+      image_name: "frontend"
+      context: "src/frontend"
+      target: runtime-prod
+
+  docker-publish-backend:
+    uses: ./.github/workflows/docker-publish.yml
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    secrets: inherit
+    with:
+      image_name: "backend"
+      context: "src/backend"
+      target: runtime-prod

.github/workflows/messages.yml

@@ -1,6 +1,6 @@
 name: Lint and tests
 
-on:
+"on":
   push:
     branches:
       - main
@@ -110,67 +110,3 @@ jobs:
         run: |
           git diff --quiet || \
           (echo "API changes detected. Please run 'make api-update' then commit the changes." && exit 1)
-
-  docker-publish-mta-in:
-    uses: ./.github/workflows/docker-publish.yml
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-    secrets: inherit
-    with:
-      image_name: "mta-in"
-      context: "src/mta-in"
-      target: runtime-prod
-
-  docker-publish-mta-out:
-    uses: ./.github/workflows/docker-publish.yml
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-    secrets: inherit
-    with:
-      image_name: "mta-out"
-      context: "src/mta-out"
-      target: runtime-prod
-
-  docker-publish-socks-proxy:
-    uses: ./.github/workflows/docker-publish.yml
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-    secrets: inherit
-    with:
-      image_name: "socks-proxy"
-      context: "src/socks-proxy"
-
-  docker-publish-frontend:
-    uses: ./.github/workflows/docker-publish.yml
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-    secrets: inherit
-    with:
-      image_name: "frontend"
-      context: "src/frontend"
-      target: runtime-prod
-
-  docker-publish-backend:
-    uses: ./.github/workflows/docker-publish.yml
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-    secrets: inherit
-    with:
-      image_name: "backend"
-      context: "src/backend"
-      target: runtime-prod