fix(ci): publish container image after CI passes on main

.changeset/fix-publish-container-image-trigger.md

@@ -0,0 +1,9 @@
+---
+"nostream": patch
+---
+
+fix(ci): publish container image after CI passes on main
+
+Removes the standalone publish workflow and its unsafe workflow_run trigger.
+Image publish now runs as the final job in checks.yml on pushes to main, after
+lint, build, and tests succeed.

.github/workflows/checks.yml

@@ -225,3 +225,56 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: Check for changeset
         run: pnpm exec changeset status --since origin/${{ github.base_ref }}
+
+  publish-container-image:
+    name: Build and push container image
+    runs-on: ubuntu-latest
+    needs:
+      - changes
+      - lint
+      - build-check
+      - test-units-and-cover
+      - test-integrations-and-cover
+      - post-tests
+    if: |
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/main' &&
+      needs.changes.result == 'success' &&
+      (needs.lint.result == 'success' || needs.lint.result == 'skipped') &&
+      (needs.build-check.result == 'success' || needs.build-check.result == 'skipped') &&
+      (needs.test-units-and-cover.result == 'success' || needs.test-units-and-cover.result == 'skipped') &&
+      (needs.test-integrations-and-cover.result == 'success' || needs.test-integrations-and-cover.result == 'skipped') &&
+      needs.post-tests.result == 'success'
+    env:
+      REGISTRY: ghcr.io
+      IMAGE_NAME: ${{ github.repository }}
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=main
+            type=sha,prefix=sha-
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}