From 5de8a9a87d84d67e5b3e5ac71154ea217c03d753 Mon Sep 17 00:00:00 2001
From: maxgfr <25312957+maxgfr@users.noreply.github.com>
Date: Mon, 5 Oct 2026 13:54:37 +0200
Subject: [PATCH] ci: dispatch image workflows after a dispatched release

grammars-repin merges with GITHUB_TOKEN and dispatches Release. GitHub
does not emit workflow_run for runs caused by GITHUB_TOKEN, so neither
main-image nor embed-image ran for ae5a3a8 and codeindex-embed:latest
lagged behind main. Dispatch both explicitly at the end of a dispatched
Release.
---
 .github/workflows/release.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9baa715..ec2f0b1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,6 +37,7 @@ permissions:
   pull-requests: write
   id-token: write
   packages: write
+  actions: write
 
 jobs:
   release:
@@ -171,3 +172,15 @@ jobs:
       - name: Return to release commit
         if: always() && steps.release.outputs.released == 'true'
         run: git checkout ${{ github.sha }}
+
+      # A dispatched Release (grammars-repin merges with GITHUB_TOKEN, then
+      # dispatches this workflow) does not fire `workflow_run` for the image
+      # workflows: GitHub suppresses events caused by GITHUB_TOKEN. Dispatch them
+      # explicitly once the gate has passed so `latest` still tracks main.
+      - name: Publish main images for a dispatched release
+        if: success() && github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh workflow run main-image.yml --ref main
+          gh workflow run embed-image.yml --ref main