[sandragjacinto]

Description

Lint and tests still run on every push. The image build and the <ref>_deploy tag now only happen for:

• main and tags (releases), as before;
• a branch whose open PR carries the preview label;
• a manual run of the workflow (Actions tab, workflow_dispatch) on any branch.

ci.yml

• A new deploy-target job decides whether to deploy. It runs alongside lint-and-test. On a branch other than main, it deploys only if the branch has an open PR labelled preview.
• build-docker runs only when deploy-target says yes, and tag-deploy waits for it.
• The shared workflows in CyberCRI/github-workflows are unchanged.

preview.yml (new)

• Label added: runs ci.yml on the branch through workflow_dispatch. That run builds the branch's last commit and tags <branch>_deploy. A pull_request run can't do this, because ref_name would be N/merge and it would check out the merge commit. Later pushes redeploy through the normal push run.
• Label removed, or PR closed: deletes <branch>_deploy if it exists. delete-ref.yml still deletes it when the branch is deleted.
• PRs from forks: ignored, since they get no secrets and no write token.

Why?

Every push to every branch built an image and moved a deploy tag. WIP pushes cost runner time, registry space and an environment. Now previews are opt-in.

How?

• Both files parse as YAML; actionlint was not run.
• The triggers can only be checked on GitHub:
  • the push run of this branch runs lint-and-test and skips build-docker / tag-deploy;
  • adding preview to this PR starts a manual run that deploys ci/preview-label-deploys_deploy;
  • removing the label deletes that tag.

Before merging

• Create the preview label. It doesn't exist in the repo yet.
• Check with whoever owns the infra side that deleting a _deploy tag removes the environment, and that nothing expects a deploy tag for every branch.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• My code follows the code style of this project.
• My code is tested.
• I have updated the documentation accordingly.