Linus Rath 582960ae06 ci: publish latest only from stable releases and scope workflow tokens ...

A manual run of the release image workflow tagged `latest` on whatever
ref it was dispatched from, and the demo deploy and every Watchtower
install follow `latest`. It now moves only for a published stable
release or a dispatch on a stable `v*` tag.

- `static-lite.yml` gave the whole workflow `contents: write`, including
  the build job that runs pull-request code. The build is read-only
  now; a separate release job with no checkout uploads the zips.
- `docker-publish.yml` passes the ref name through `env` instead of
  interpolating it into the shell script.

2026-09-26 16:30:23 +02:00

..

deploy-demo.yml

ci: deploy demo.bulwarkmail.org from here instead of Watchtower

2026-09-20 02:57:52 +02:00

docker-publish-lite.yml

feat: publish Bulwark Lite as a container image #1081

2026-09-21 22:56:26 +02:00

docker-publish-releases.yml

ci: publish latest only from stable releases and scope workflow tokens

2026-09-26 16:30:23 +02:00

docker-publish.yml

ci: publish latest only from stable releases and scope workflow tokens

2026-09-26 16:30:23 +02:00

standalone-release.yml

feat: publish standalone tarball on release

2026-04-11 23:28:39 +02:00

static-lite.yml

ci: publish latest only from stable releases and scope workflow tokens

2026-09-26 16:30:23 +02:00

tests.yml

feat: run the test suite in CI #647

2026-09-07 22:34:47 +02:00