chore: update Docker and release workflows for improved efficiency and security (#239)

.github/workflows/docker.yml

@@ -12,6 +12,7 @@ on:
       - "dev/docker-compose.yml"
       - "dev/sandbox/**"
       - ".github/workflows/docker.yml"
+  workflow_dispatch:
 
 concurrency:
   group: docker-${{ github.event.pull_request.number || github.ref }}
@@ -22,14 +23,50 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
-    build-and-push:
+  pr-smoke:
+    name: PR Docker Smoke
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=pr
+
+      - name: Build smoke image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: false
+          load: true
+          tags: zeroclaw-pr-smoke:latest
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          platforms: linux/amd64
+
+      - name: Verify image
+        run: docker run --rm zeroclaw-pr-smoke:latest --version
+
+  publish:
     name: Build and Push Docker Image
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 25
     permissions:
       contents: read
       packages: write
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -38,7 +75,6 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to Container Registry
-              if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -52,14 +88,12 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=ref,event=branch
-                      type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
             type=raw,value=latest,enable={{is_default_branch}}
 
-            - name: Build and push Docker image (push/tag)
+      - name: Build and push Docker image
-              if: github.event_name != 'pull_request'
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -69,20 +103,3 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: ${{ startsWith(github.ref, 'refs/tags/') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
-
-            - name: Build smoke image (PR only)
-              if: github.event_name == 'pull_request'
-              uses: docker/build-push-action@v5
-              with:
-                  context: .
-                  push: false
-                  load: true
-                  tags: zeroclaw-pr-smoke:latest
-                  labels: ${{ steps.meta.outputs.labels }}
-                  cache-from: type=gha
-                  platforms: linux/amd64
-
-            - name: Verify image (PR only)
-              if: github.event_name == 'pull_request'
-              run: |
-                  docker run --rm zeroclaw-pr-smoke:latest --version

.github/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
       - uses: Swatinem/rust-cache@v2
 
       - name: Build release
-        run: cargo build --release --target ${{ matrix.target }}
+        run: cargo build --release --locked --target ${{ matrix.target }}
 
       - name: Check binary size (Unix)
         if: runner.os != 'Windows'

.github/workflows/security.yml

@@ -21,7 +21,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
 
       - name: Install cargo-audit
-        run: cargo install cargo-audit
+        run: cargo install --locked cargo-audit --version 0.22.1
 
       - name: Run cargo-audit
         run: cargo audit