refactor: split release and deploy into separate workflows

.github/workflows/deploy.yml

@@ -1,101 +1,21 @@
 name: Deploy
 
 on:
-  push:
-    tags:
-      - "v*"
+  workflow_run:
+    workflows: [Release]
+    types: [completed]
 
 env:
-  CARGO_TERM_COLOR: always
   IMAGE_NAME: networkcat/rustyip
 
 permissions:
   contents: read
 
 jobs:
-  # ---- CI checks ----
-  check:
-    name: Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: "1.93.1"
-          components: rustfmt, clippy
-
-      - name: Cache Cargo artifacts
-        uses: Swatinem/rust-cache@v2
-
-      - name: Download MMDB database
-        run: |
-          mkdir -p data
-          curl -fsSL -o data/Merged-IP.mmdb \
-            "https://github.com/NetworkCats/Merged-IP-Data/releases/latest/download/Merged-IP.mmdb"
-
-      - name: Check formatting
-        run: cargo fmt --check
-
-      - name: Run Clippy
-        run: cargo clippy -- -D warnings
-
-      - name: Run tests
-        run: cargo test
-
-  # ---- Build and push Docker image ----
-  build:
-    name: Build Image
-    runs-on: ubuntu-latest
-    needs: check
-    outputs:
-      image_tag: ${{ steps.meta.outputs.tags }}
-      image_full: ${{ steps.full_image.outputs.image }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.IMAGE_NAME }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=raw,value=latest
-
-      - name: Build and push image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Set full image reference
-        id: full_image
-        run: |
-          TAG="${GITHUB_REF_NAME#v}"
-          echo "image=${{ env.IMAGE_NAME }}:${TAG}" >> "$GITHUB_OUTPUT"
-
-  # ---- Deploy to VPS ----
   deploy:
     name: Deploy
     runs-on: ubuntu-latest
-    needs: build
+    if: github.event.workflow_run.conclusion == 'success'
     environment: production
     concurrency:
       group: deploy-production
@@ -104,6 +24,13 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Resolve image tag from release
+        id: image
+        run: |
+          TAG="${{ github.event.workflow_run.head_branch }}"
+          TAG="${TAG#v}"
+          echo "full=${{ env.IMAGE_NAME }}:${TAG}" >> "$GITHUB_OUTPUT"
+
       # ---- Terraform: provision infrastructure ----
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3
@@ -191,7 +118,7 @@ jobs:
       - name: Run Ansible playbook
         working-directory: deploy/ansible
         env:
-          APP_IMAGE: ${{ needs.build.outputs.image_full }}
+          APP_IMAGE: ${{ steps.image.outputs.full }}
           SITE_DOMAIN: ${{ secrets.SITE_DOMAIN }}
           DB_UPDATE_URL: ${{ secrets.DB_UPDATE_URL }}
           ORIGIN_CERT: ${{ secrets.ORIGIN_CERT }}