Prevent race dispatch image publishing

Author: dzarlax

.github/workflows/ci.yml

@@ -74,7 +74,7 @@ jobs:
     name: Docker Build & Push (amd64)
     needs: build
     runs-on: ubuntu-latest
-    if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.build_amd64)) }}
+    if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.build_amd64 && !inputs.run_race)) }}
     permissions:
       contents: read
       packages: write
@@ -115,7 +115,7 @@ jobs:
     name: Docker Build & Push (arm64)
     needs: build
     runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'workflow_dispatch' && inputs.build_arm64 }}
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.build_arm64 && !inputs.run_race }}
     permissions:
       contents: read
       packages: write

CONTRIBUTING.md

@@ -29,7 +29,7 @@ DB-backed integration tests skip when no Postgres connection is configured. To r
 
 The default required-looking CI job is `Build, Vet & Test`. Keep that job name stable unless repository branch protection is updated at the same time.
 
-Default PR and push CI uses `CGO_ENABLED=0` for build, vet, and tests, matching the production binary. Race detector tests are available as a manual GitHub Actions run: start the `CI` workflow with `run_race=true`. Use this before merging changes that touch tenant management, scheduler goroutines, async AI generation, recompute coordination, Telegram webhook dispatch, or notification loops.
+Default PR and push CI uses `CGO_ENABLED=0` for build, vet, and tests, matching the production binary. Race detector tests are available as a manual GitHub Actions run: start the `CI` workflow with `run_race=true`. Race-only dispatches do not publish Docker images, even when the image build inputs are left at their defaults. Use this before merging changes that touch tenant management, scheduler goroutines, async AI generation, recompute coordination, Telegram webhook dispatch, or notification loops.
 
 For local checks on a machine with a CGO toolchain:
 

docs/ai-plans/2026-06-06-issue-152-ci-race-detector-branch-protection-policy.html

@@ -133,6 +133,7 @@ <h2>Implementation Result</h2>
       <li>Kept the default <code>Build, Vet &amp; Test</code> job name stable.</li>
       <li>Added a manual-only <code>Race Detector</code> job behind <code>workflow_dispatch</code> input <code>run_race=true</code>.</li>
       <li>Race detector job runs <code>CGO_ENABLED=1 go test -race ./...</code> and is not required on normal PR or push runs.</li>
+      <li>Guarded Docker publish jobs so race-only dispatches do not push images when <code>run_race=true</code>.</li>
       <li>Documented local and CI race-detector guidance in <code>CONTRIBUTING.md</code>.</li>
       <li>Recorded current branch protection state: GitHub API returned <code>Branch not protected</code> for <code>main</code> on 2026-06-06.</li>
     </ul>
@@ -144,6 +145,7 @@ <h2>Verification Run</h2>
       <li><code>go test ./...</code></li>
       <li><code>go vet ./...</code></li>
       <li><code>CGO_ENABLED=1 go test -race ./...</code> on Windows was blocked before tests by missing <code>gcc</code> in <code>PATH</code>; the manual GitHub Actions job is the Ubuntu validation path.</li>
+      <li>Manual GitHub Actions run <code>27062004434</code> passed with <code>run_race=true</code>, including the <code>Race Detector</code> job on Ubuntu.</li>
       <li><code>gh api repos/Dzarlax-AI/health_dashboard/branches/main/protection</code> returned <code>404 Branch not protected</code>.</li>
     </ul>
   </section>