run build only when tagged

.github/workflows/build.yml

@@ -3,6 +3,7 @@ name: Build and push container
 on:
   push:
     branches: [ main ]
+    tags: [ '*' ]
 
 env:
   REGISTRY: ghcr.io
@@ -28,6 +29,8 @@ jobs:
 
     - name: Build and push
       run: bin/build.sh
+      env:
+        TAG: ${{ github.ref_name }}
 
     - name: Build Summary
       if: always()

README.md

@@ -24,6 +24,19 @@ Deployment will eventually be automatic, but in the meantime, the infrastructure
 
 To ignore files from deployment, specify them in `.distignore`.
 
+**Notes for the infrastructure team:**
+
+```
+# In this repo (fairpm/server)
+git checkout main
+git tag -f production
+git push --tags
+
+# Then in the fairpm/infrastructure-private repo
+./jazz
+cd helm/projects/site
+bin/deploy production
+```
 
 ## License
 

bin/build.sh

@@ -40,9 +40,15 @@ if [ $? -ne 0 ]; then
 	exit 1
 fi
 
+extra_tag=''
+[[ -n ${TAG:-} ]] && extra_tag="--tag ghcr.io/fairpm/server:${TAG}"
+
 echo "Building image…" >&2
+
+# shellcheck disable=SC2086
 docker build \
 	--tag ghcr.io/fairpm/server:latest \
+	$extra_tag \
 	--build-context src="$BUILD_DIR" \
 	"$SCRIPT_DIR/container"