ci: publish gateway image only for release tags

Author: coder-hhx

.github/workflows/gateway-docker.yml

@@ -1,21 +1,18 @@
 name: Gateway Docker
 
 on:
-  workflow_run:
-    workflows:
-      - CI
-    types:
-      - completed
   push:
     tags:
       - "v*"
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to publish, for example v0.1.0
+        required: true
 
 permissions:
   contents: read
   packages: write
-  id-token: write
-  attestations: write
 
 env:
   IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/liveagent-gateway
@@ -24,11 +21,10 @@ jobs:
   build-and-push:
     name: Build and Push Gateway Image
     runs-on: ubuntu-latest
-    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main')
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.workflow_run.head_sha || github.ref }}
+          ref: ${{ github.event.inputs.tag || github.ref }}
 
       - uses: docker/setup-qemu-action@v3
 
@@ -46,13 +42,11 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.IMAGE_NAME }}
+          flavor: |
+            latest=false
           tags: |
-            type=ref,event=branch,enable=${{ github.event_name != 'workflow_run' }}
-            type=ref,event=tag,enable=${{ github.event_name != 'workflow_run' }}
-            type=sha,prefix=sha-,enable=${{ github.event_name != 'workflow_run' }}
-            type=raw,value=main,enable=${{ github.event_name == 'workflow_run' }}
-            type=raw,value=sha-${{ github.event.workflow_run.head_sha }},enable=${{ github.event_name == 'workflow_run' }}
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=raw,value=${{ github.event.inputs.tag || github.ref_name }}
+            type=raw,value=latest
 
       - name: Build and push
         id: push
@@ -66,10 +60,4 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-
-      - name: Attest image provenance
-        uses: actions/attest-build-provenance@v2
-        with:
-          subject-name: ${{ env.IMAGE_NAME }}
-          subject-digest: ${{ steps.push.outputs.digest }}
-          push-to-registry: true
+          provenance: false

docs/operations/deployment.md

@@ -7,8 +7,7 @@
 | 入口 | Workflow | 动作 |
 |---|---|---|
 | PR / `main` push | `.github/workflows/ci.yml` | 跑 Gateway、WebUI、GUI、Tauri Rust 测试和 proto 一致性检查。 |
-| `main` push 且 CI 成功 | `.github/workflows/gateway-docker.yml` | 构建并推送 `ghcr.io/<owner>/liveagent-gateway:main` 与 `sha-*` 镜像。 |
-| `v*` tag | `.github/workflows/gateway-docker.yml` | 构建并推送 `vX.Y.Z` 与 `latest` Gateway 镜像。 |
+| `v*` tag / 手动指定 tag | `.github/workflows/gateway-docker.yml` | 构建并推送 `vX.Y.Z` 与 `latest` Gateway 镜像。 |
 | `v*` tag | `.github/workflows/desktop-release.yml` | 并行构建 macOS Intel、macOS Apple Silicon 和 Windows x64 桌面包，并上传到 GitHub Release。 |
 
 ## Gateway 镜像
@@ -39,7 +38,7 @@ CI 中的 `Gateway Docker Smoke` job 会执行同等检查：构建镜像、启
 
 ## 用户自部署 Gateway
 
-LiveAgent 不提供托管 Gateway 服务。需要公网 Remote Gateway 的用户可以用自己的 Railway 账号部署本仓库，或在其他 Docker 平台部署 `ghcr.io/<owner>/liveagent-gateway` 镜像。
+LiveAgent 不提供托管 Gateway 服务。需要公网 Remote Gateway 的用户可以用自己的 Railway 账号部署本仓库，或在其他 Docker 平台部署 `ghcr.io/<owner>/liveagent-gateway:vX.Y.Z` / `latest` 镜像。
 
 Railway 自部署路径：