From b199933b6ccc5c5b498470fa7dc7546c44e8934e Mon Sep 17 00:00:00 2001
From: Chingis S <chingis@chingis.io>
Date: Sun, 30 Aug 2026 18:47:24 +0300
Subject: [PATCH] Isolate Docker publishing from pull requests

Run pull-request builds and tests without Docker Hub credentials. Restrict registry login and image publishing to trusted push and tag workflows.
---
 .github/workflows/workflow.yml | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml
index d587ecd..c020b2a 100644
--- a/.github/workflows/workflow.yml
+++ b/.github/workflows/workflow.yml
@@ -62,11 +62,24 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v6
+      - name: Build and test
+        env:
+          PHP_VER: ${{ matrix.php.version }}
+          ARCH: ${{ matrix.arch }}
+          PHP_DEV: ${{ matrix.dev }}
+          WODBY_USER_ID: ${{ matrix.user_id }}
+          WODBY_GROUP_ID: ${{ matrix.group_id }}
+        working-directory: ${{ matrix.php.workdir }}
+        run: |
+          make
+          make test
       - uses: docker/login-action@v3
+        if: github.event_name == 'push'
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: build and push
+      - name: Push architecture image
+        if: github.event_name == 'push'
         env:
           PHP_VER: ${{ matrix.php.version }}
           ARCH: ${{ matrix.arch }}
@@ -74,12 +87,10 @@ jobs:
           WODBY_USER_ID: ${{ matrix.user_id }}
           WODBY_GROUP_ID: ${{ matrix.group_id }}
         working-directory: ${{ matrix.php.workdir }}
-        run: |
-          make
-          make test
-          make push
+        run: make push
 
   push:
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     needs:
       - setup