From 4700abe1a364923d81548adaa90ab4f59d55e4a7 Mon Sep 17 00:00:00 2001
From: Zoheb Shaikh <26975142+ZohebShaikh@users.noreply.github.com>
Date: Wed, 21 Oct 2026 09:15:17 +0100
Subject: [PATCH] Only publish container and Helm chart when all checks pass

Gate publish on lint and system-test as well as test, skip helm_publish
when publish is false, and drop the unused metadata step that read
undefined env vars.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/_container.yml | 9 +--------
 .github/workflows/ci.yml         | 4 ++--
 2 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/_container.yml b/.github/workflows/_container.yml
index 690576fe1c..10fcf578af 100644
--- a/.github/workflows/_container.yml
+++ b/.github/workflows/_container.yml
@@ -80,7 +80,7 @@ jobs:
   helm_publish:
     name: publish gcr
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/')
+    if: inputs.publish && startsWith(github.ref, 'refs/tags/')
     environment: prod
     needs: build_container
     steps:
@@ -96,13 +96,6 @@ jobs:
       - name: login to gcr using helm
         run: |
           echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io --username ${{ github.repository_owner }} --password-stdin
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@418e4b98bf2841bd337d0b24fe63cb36dc8afa55
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=tag
 
       - name: package chart and push it
         env:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 54b29171b4..d8886712e7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,11 +35,11 @@ jobs:
     uses: ./.github/workflows/_system_test.yml
 
   container:
-    needs: test
+    needs: [lint, test, system-test]
     if: always()
     uses: ./.github/workflows/_container.yml
     with:
-      publish: ${{ needs.test.result == 'success' }}
+      publish: ${{ needs.lint.result == 'success' && needs.test.result == 'success' && needs.system-test.result == 'success' }}
     permissions:
       contents: read
       packages: write