Hongming Wang 3531f19668 fix(publish-image): drop pull_request trigger — leaks PR builds to GHCR ... `on: pull_request:` was the only template-repo with this trigger out of the 8 (other 7 trigger only on push:main, repository_dispatch, workflow_dispatch). The reusable publish-template-image workflow has no PR-skip guard, so the PR trigger fired every time a PR was opened or updated and pushed both `:latest` (clobbering the production tag with unmerged code) and `:sha-<7>` (a stable tag for an unmerged commit) to GHCR. Verification at PR time already happens via the validate-workspace-template workflow's "Docker build smoke test" step, which builds the image but does NOT push. That's the right place for PR-time verification. Removing the trigger here aligns claude-code with the canonical 7 templates and stops the GHCR leak. While here, updated the runtime_version comment to drop the now- stale "/PR" reference.		2026-04-27 15:15:46 -07:00
..
ci.yml	ci: add standard workspace template validation workflow	2026-04-16 04:43:13 -07:00
publish-image.yml	fix(publish-image): drop pull_request trigger — leaks PR builds to GHCR	2026-04-27 15:15:46 -07:00