ci: publish portable containers after successful main deployment

src/lib/deploy-workflow-contract.test.ts

@@ -39,3 +39,17 @@ it("builds the checked out source without fetching a moving remote branch", () =
 	);
 	expect(dockerfile).not.toMatch(/^RUN\s+git\s+(?:pull|fetch|clone)\b/m);
 });
+
+it("publishes commit images after successful main deployment and preserves manual retries", () => {
+	const publish = workflow.slice(workflow.indexOf("\n  publish-container:"));
+	expect(publish).toContain("needs: deploy");
+	expect(publish).toContain("gitea.event_name == 'push'");
+	expect(publish).toContain("gitea.ref_name == 'main'");
+	expect(publish).toContain("gitea.ref_name == 'master'");
+	expect(publish).toContain("bash scripts/publish-container.sh");
+	expect(publish).toContain("secrets.CONTAINER_REGISTRY_USER");
+	expect(publish).toContain("secrets.CONTAINER_REGISTRY_TOKEN");
+	const manual = readFileSync(".gitea/workflows/container.yaml", "utf8");
+	expect(manual).toContain("workflow_dispatch:");
+	expect(manual).not.toMatch(/^ {2}push:/m);
+});