From 5ca71853eb10e3959e44e68f88b54c210943905c Mon Sep 17 00:00:00 2001
From: Aryan Singh <asing271@illinois.edu>
Date: Wed, 2 Sep 2026 00:07:09 -0500
Subject: [PATCH] Build the image on PRs so it is verified before merge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The publish workflow only fired on push to main and on v* tags, which
meant the Dockerfile got no CI coverage at all until after it landed —
and the workflow could not be observed working before merging it.

PRs now run the same build with push disabled, amd64 only (the emulated
arm64 leg is the slow part and is not needed to prove the build works).
Login, SBOM, provenance and attestation are skipped when not publishing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/docker-publish.yml | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index c7bfa38..ac95d9d 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -4,6 +4,10 @@ on:
   push:
     branches: [main]
     tags: ["v*.*.*"]
+  # Build (but do not publish) on PRs, so a broken Dockerfile is caught before
+  # it reaches main rather than after. Without this the image build gets no
+  # coverage at all until merge.
+  pull_request:
   workflow_dispatch:
 
 env:
@@ -34,6 +38,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -67,16 +72,22 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: ./client
-          platforms: linux/amd64,linux/arm64
-          push: true
+          # PRs only need to prove the image builds; the emulated arm64 leg is
+          # the slow part, so save it for builds that actually publish.
+          platforms: >-
+            ${{ github.event_name == 'pull_request'
+                && 'linux/amd64'
+                || 'linux/amd64,linux/arm64' }}
+          push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          provenance: mode=max
-          sbom: true
+          provenance: ${{ github.event_name != 'pull_request' && 'mode=max' || 'false' }}
+          sbom: ${{ github.event_name != 'pull_request' }}
 
       - name: Attest build provenance
+        if: github.event_name != 'pull_request'
         uses: actions/attest-build-provenance@v2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}