From e25639c11b4061298025c835668b7c12d81eb221 Mon Sep 17 00:00:00 2001
From: Zyy <zyycn@users.noreply.github.com>
Date: Mon, 31 Aug 2026 04:40:24 +0800
Subject: [PATCH] fix(release): gate publishing on container validation

Skip standalone CI for version-only release commits so they do not cancel the preceding source run. Reuse the container workflow in Release and require it before publishing.

Co-authored-by: Codex <noreply@openai.com>
---
 .github/workflows/ci.yml      |  2 ++
 .github/workflows/release.yml | 11 ++++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5778b3e30..db90fda79 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - main
+    paths-ignore:
+      - 'release/version.yaml'
   pull_request:
     branches:
       - main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2e114ca97..16d8a04de 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -163,6 +163,15 @@ jobs:
       ref: ${{ needs.release-info.outputs.git_sha }}
       upload_frontend: true
 
+  container:
+    needs: [release-info]
+    permissions:
+      contents: read
+      security-events: write
+    uses: ./.github/workflows/_container.yml
+    with:
+      ref: ${{ needs.release-info.outputs.git_sha }}
+
   build-docker-binary:
     name: build-docker-binary (${{ matrix.os }}-${{ matrix.arch }})
     needs: release-info
@@ -497,7 +506,7 @@ jobs:
           exit-code: '1'
 
   publish:
-    needs: [release-info, package-assets, build-docker-image]
+    needs: [release-info, package-assets, build-docker-image, container]
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions: