From 349fe31592268d05ff1fb53117cc1da30ce5d125 Mon Sep 17 00:00:00 2001
From: 3alpha <15694175+3alpha@users.noreply.github.com>
Date: Thu, 9 Jul 2026 10:19:20 +0200
Subject: [PATCH 1/2] ci: use dappnode-build-hash reusable workflow

Splits the build-hash logic into a thin caller for the new
`dappnode/workflows/.github/workflows/dappnode-build-hash.yml@master`
reusable workflow. `build.yml` (new) now handles both push and
workflow_dispatch; `main.yml` is reduced to the release job only.

Also upgrades `actions/checkout` to v7 and Node 24 (with
`actions/setup-node@v6`) for the release job.

The reusable workflow auto-detects the event: on push to a non-default
branch it builds, pins to Pinata, and posts a comment authored by
tropibot[bot] on the PR; on push to the default branch it does a
test build only. (The previous `if: github.event_name == 'push'
&& github.ref != 'refs/heads/main'` guard is no longer needed
because the SDK already handles that case.)
---
 .github/workflows/build.yml | 11 +++++++++++
 .github/workflows/main.yml  | 19 ++-----------------
 2 files changed, 13 insertions(+), 17 deletions(-)
 create mode 100644 .github/workflows/build.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..f5ec9ab
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,11 @@
+name: Build
+
+on:
+  workflow_dispatch:
+  push:
+    paths-ignore: ["README.md"]
+
+jobs:
+  build:
+    uses: dappnode/workflows/.github/workflows/dappnode-build-hash.yml@master
+    secrets: inherit
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 86ce580..aee075d 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -6,30 +6,15 @@ on:
       - "README.md"
 
 jobs:
-  build-hash:
-    runs-on: ubuntu-latest
-    name: Build and post IPFS hash
-    if: github.event_name == 'push' && github.ref != 'refs/heads/main'
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "22"
-      - run: npx @dappnode/dappnodesdk github-action build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PINATA_API_KEY: ${{ secrets.PINATA_API_KEY }}
-          PINATA_SECRET_API_KEY: ${{ secrets.PINATA_SECRET_API_KEY }}
-
   release:
     name: Release
     runs-on: ipfs-dev-gateway
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'repository_dispatch'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: "24"
       - name: Log in to GitHub Container Registry
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
       - name: Publish

From 9a3298bf3af200397d2284f3e8f418c9dc05d556 Mon Sep 17 00:00:00 2001
From: 3alpha <15694175+3alpha@users.noreply.github.com>
Date: Thu, 9 Jul 2026 10:28:24 +0200
Subject: [PATCH 2/2] refactor(ci): move release branch filter into
 on.push.branches

The release job used a broad `on.push` (no branch filter) plus an
`if:` condition that checked `github.ref == 'refs/heads/<default>'`.
This worked but was verbose and easy to get wrong (tailscale had
`refs/heads/main` instead of `refs/heads/master`).

Simplify: filter in the trigger itself, drop the `if` condition.
Same behavior, half the YAML. Also adds `workflow_dispatch` so the
release can be triggered manually.
---
 .github/workflows/main.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index aee075d..ff4f321 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,15 +1,17 @@
 name: "Main"
 on:
-  repository_dispatch:
   push:
+    branches:
+      - "main"
     paths-ignore:
       - "README.md"
+  repository_dispatch:
+  workflow_dispatch:
 
 jobs:
   release:
     name: Release
     runs-on: ipfs-dev-gateway
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'repository_dispatch'
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v6