From 258474c2d6f05ab4fb1c3c57ac93a70482c222d6 Mon Sep 17 00:00:00 2001
From: Shahan Khatchadourian <shahan.khatchadourian@anchorlabs.com>
Date: Fri, 27 Mar 2026 10:58:52 -0400
Subject: [PATCH 1/2] ci(stagex): label-triggered PR builds and deferred GHCR
 login

- PR image builds now require the `stagex` label instead of
  auto-triggering on path changes. Push to main/tags unchanged.
- GHCR credentials moved after build step so build runs without
  registry write access.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/stagex.yml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/stagex.yml b/.github/workflows/stagex.yml
index b655f784..8e7b5cc7 100644
--- a/.github/workflows/stagex.yml
+++ b/.github/workflows/stagex.yml
@@ -12,16 +12,15 @@ on:
       - "images/**"
       - "Makefile"
   pull_request:
-    paths:
-      - ".github/**"
-      - "src/**"
-      - "images/**"
-      - "Makefile"
+    types: [labeled]
   workflow_dispatch: # Allows manual invocation
 
 jobs:
   parser:
     name: Build parser images
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.label.name == 'stagex'
     runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:
@@ -47,7 +46,6 @@ jobs:
         uses: ./.github/actions/docker-setup
         with:
           dockerHub: ${{ secrets.DOCKERHUB_API_KEY }}
-          ghcr: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build ${{ matrix.target.name }}
         shell: bash
@@ -58,6 +56,10 @@ jobs:
         run: |
           env -C out/${{ matrix.target.name }} tar -cf - . | docker load
 
+      - name: Login to GHCR
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
       - name: Upload to GHCR
         run: |
           for tag in ${tags}; do

From f6cb1669141732f7cf2955a75c9b12d5cf107eca Mon Sep 17 00:00:00 2001
From: Shahan Khatchadourian <shahan.khatchadourian@anchorlabs.com>
Date: Fri, 27 Mar 2026 12:06:21 -0400
Subject: [PATCH 2/2] ci(main): disable setup-rust-toolchain built-in cache

The action's bundled Swatinem/rust-cache fails because Cargo.toml is
in src/, not the repo root. The manual actions/cache step already
handles caching correctly. Disabling removes the error noise.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/main.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 452ceb67..7e4d6595 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -23,6 +23,7 @@ jobs:
         uses: actions-rust-lang/setup-rust-toolchain@fb51252c7ba57d633bc668f941da052e410add48 # v1.13.0
         with:
           components: clippy, rustfmt
+          cache: false
 
       - name: Cache Rust dependencies
         uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4