ci: retire Docker build/push, publishing moved to postguard

.github/workflows/ci.yml

@@ -3,11 +3,12 @@ name: CI
 # Pipeline overview
 # =================
 #
-# Release-plz and Docker delivery are combined in one workflow because
-# GITHUB_TOKEN-created tags do not trigger new workflow runs. This means a
-# versioned Docker image must be built in the same run that release-plz
-# creates the release, using its job outputs to pass the version through.
+# Rust quality gate plus release-plz's release/changelog-PR management.
 #
+# Docker publishing moved to encryption4all/postguard, which builds this
+# crate as a workspace member and pushes the same ghcr.io/encryption4all/
+# cryptify image name (postguard#293). This workflow no longer builds or
+# pushes any image.
 
 on:
   push:
@@ -18,7 +19,7 @@ on:
 jobs:
 
   # Rust quality gate: fmt, clippy, tests. Runs on every PR and on push to
-  # main, in parallel to the release-plz/Docker pipeline (does not block it).
+  # main, in parallel to release-plz (does not block it).
   quality:
     name: Rust quality (fmt, clippy, test)
     runs-on: ubuntu-latest
@@ -47,9 +48,6 @@ jobs:
       contents: write
       pull-requests: read
       id-token: write
-    outputs:
-      releases_created: ${{ steps.release-plz.outputs.releases_created }}
-      version: ${{ steps.parse-release.outputs.version }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -66,12 +64,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-      - name: Parse released version
-        id: parse-release
-        if: steps.release-plz.outputs.releases_created == 'true'
-        run: |
-          VERSION=$(echo '${{ steps.release-plz.outputs.releases }}' | jq -r '.[0].version')
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
 
   # Create a PR with the new versions and changelog, preparing the next release.
   release-plz-pr:
@@ -100,93 +92,3 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-
-  # Build each platform on its native runner and push by digest (no tag yet).
-  build:
-    name: Build (${{ matrix.name }})
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-      packages: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-24.04
-            name: amd64
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-            name: arm64
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-      - name: Log in to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push by digest
-        id: build
-        uses: docker/build-push-action@v7
-        with:
-          platforms: ${{ matrix.platform }}
-          outputs: type=image,name=ghcr.io/${{ github.repository }},push-by-digest=true,name-canonical=true,push=true
-      - name: Export digest
-        run: |
-          mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
-      - name: Upload digest
-        uses: actions/upload-artifact@v7
-        with:
-          name: digest-${{ matrix.name }}
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-  # Merge platform digests into a single multi-platform manifest and apply tags.
-  # - push to main (no release)  → ghcr.io/.../cryptify:edge
-  # - push to main (release)     → ghcr.io/.../cryptify:edge + cryptify:0.1.3
-  # - pull request               → ghcr.io/.../cryptify:pr-123
-  finalize:
-    name: Finalize Docker manifest
-    needs: [build, release-plz-release]
-    if: always() && needs.build.result == 'success'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@v8
-        with:
-          path: /tmp/digests
-          pattern: digest-*
-          merge-multiple: true
-      - name: Docker metadata
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tags: |
-            type=edge,branch=main
-            type=ref,event=pr
-            type=raw,value=${{ needs.release-plz-release.outputs.version }},enable=${{ needs.release-plz-release.outputs.releases_created == 'true' }}
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-      - name: Log in to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Create and push manifest
-        working-directory: /tmp/digests
-        run: |
-          docker buildx imagetools create \
-            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf 'ghcr.io/${{ github.repository }}@sha256:%s ' *)