fix(ci): move docker publish into release-please workflow

.github/workflows/publish.yml

@@ -1,8 +1,12 @@
 name: Publish Release
 
 on:
-  release:
-    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v0.2.0)"
+        required: true
+        type: string
 
 jobs:
   publish:
@@ -13,6 +17,8 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag }}
       - uses: DeterminateSystems/nix-installer-action@v21
       - uses: DeterminateSystems/magic-nix-cache-action@v13
       - name: Log in to GHCR
@@ -27,7 +33,7 @@ jobs:
         run: |
           set -euo pipefail
           docker load < ./result
-          VERSION="${GITHUB_REF_NAME}"
+          VERSION="${{ inputs.tag }}"
           docker tag ghcr.io/jordangarrison/greenlight:latest "ghcr.io/jordangarrison/greenlight:${VERSION}"
           docker push ghcr.io/jordangarrison/greenlight:latest
           docker push "ghcr.io/jordangarrison/greenlight:${VERSION}"

.github/workflows/release-please.yml

@@ -15,8 +15,41 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - uses: googleapis/release-please-action@v4
+        id: release
         with:
           config-file: .release-please-config.json
           manifest-file: .release-please-manifest.json
+
+  publish:
+    name: Build & Push Release Image
+    needs: release
+    if: ${{ needs.release.outputs.release_created }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: DeterminateSystems/nix-installer-action@v21
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build container image
+        run: nix build .#dockerImage
+      - name: Push release image
+        run: |
+          set -euo pipefail
+          docker load < ./result
+          VERSION="${{ needs.release.outputs.tag_name }}"
+          docker tag ghcr.io/jordangarrison/greenlight:latest "ghcr.io/jordangarrison/greenlight:${VERSION}"
+          docker push ghcr.io/jordangarrison/greenlight:latest
+          docker push "ghcr.io/jordangarrison/greenlight:${VERSION}"

flake.nix

@@ -52,6 +52,12 @@
           shellHook = ''
             mix local.hex --if-missing --force
             mix local.rebar --if-missing --force
+
+            if [ ! -f _build/.setup_done ]; then
+              echo "First-time setup: running mix setup..."
+              mix setup
+              mkdir -p _build && touch _build/.setup_done
+            fi
           '';
         };
       }