Reduce repeated CLI builds and isolate CI publication

.github/workflows/cli-docker.yml

@@ -1,6 +1,6 @@
-# Build and push the CLI Docker image to GitHub Container Registry (GHCR).#
-# Image tag format: <manifest-version>-<unix-epoch>-cli
-# Example: 0.25.56-1743500000-cli
+# Build and push the CLI Docker image to GitHub Container Registry (GHCR).
+# Image tag format: <manifest-version>-cli
+# Example: 1.0.36-cli
 #
 # Stable releases are also tagged with their major-minor version and 'latest'.
 # Pre-releases receive immutable version and SHA-qualified tags only.
@@ -13,16 +13,24 @@ on:
             - main
         tags:
             - "*.*.*-cli"
-        paths-ignore:
-            - "docs/**"
-            - "*.md"
-            - "images/**"
-            - "assets/**"
-            - "instruction_images/**"
-            - "src/apps/webapp/**"
-            - "src/apps/webpeer/**"
-            - ".github/workflows/release.yml"
-            - ".github/workflows/unit-ci.yml"
+        paths:
+            - ".github/workflows/cli-docker.yml"
+            - ".github/workflows/cli-docker-validation.yml"
+            - "src/apps/cli/**"
+            - "!src/apps/cli/**/*.md"
+            - "src/LiveSyncBaseCore.ts"
+            - "src/common/**"
+            - "src/serviceFeatures/**"
+            - "src/serviceModules/**"
+            - "src/integrations/**"
+            - "src/modules/AbstractModule.ts"
+            - "src/modules/main/**"
+            - "src/modules/coreFeatures/**"
+            - "manifest.json"
+            - "tsconfig.json"
+            - "package.json"
+            - "package-lock.json"
+            - ".dockerignore"
     workflow_dispatch:
         inputs:
             dry_run:
@@ -36,8 +44,21 @@ on:
                 type: boolean
                 default: false
 
+concurrency:
+    group: cli-docker-publish-${{ github.ref }}
+    cancel-in-progress: false
+
 jobs:
+    validate:
+        uses: ./.github/workflows/cli-docker-validation.yml
+        with:
+            force: ${{ github.event_name == 'workflow_dispatch' && inputs.force || false }}
+        permissions:
+            contents: read
+
     build-and-push:
+        needs: validate
+        if: ${{ needs.validate.outputs.e2e_passed == 'true' || (github.event_name == 'workflow_dispatch' && inputs.force) }}
         runs-on: ubuntu-latest
         timeout-minutes: 90
         permissions:
@@ -100,34 +121,7 @@ jobs:
             - name: Set up Docker Buildx
               uses: docker/setup-buildx-action@v4
 
-            - name: Setup Node.js
-              uses: actions/setup-node@v5
-              with:
-                  node-version: "24.x"
-                  cache: "npm"
-
-            - name: Install dependencies
-              run: npm ci
-
-            - name: Run CLI E2E (docker)
-              id: e2e
-              continue-on-error: ${{ github.event_name == 'workflow_dispatch' && inputs.force }}
-              working-directory: src/apps/cli
-              env:
-                  CI: true
-              run: npm run test:e2e:docker:all
-
-            - name: Stop test containers (safety net)
-              if: always()
-              working-directory: src/apps/cli
-              run: |
-                  # Keep this as a safety net for future suites/steps that may leave containers running.
-                  bash ./util/couchdb-stop.sh >/dev/null 2>&1 || true
-                  bash ./util/minio-stop.sh >/dev/null 2>&1 || true
-                  bash ./util/p2p-stop.sh >/dev/null 2>&1 || true
-
             - name: Build and push
-              if: ${{ steps.e2e.outcome == 'success' || (github.event_name == 'workflow_dispatch' && inputs.force) }}
               uses: docker/build-push-action@v7
               with:
                   context: .
@@ -135,5 +129,5 @@ jobs:
                   push: ${{ steps.meta.outputs.push }}
                   tags: ${{ steps.meta.outputs.tags }}
                   platforms: linux/amd64,linux/arm64
-                  cache-from: type=gha
-                  cache-to: type=gha,mode=max
+                  cache-from: type=gha,scope=cli-image
+                  cache-to: type=gha,scope=cli-image,mode=max