chore(ci): skip release-only setup on dev publishes - #56074

Stacked on #56073 (desktop-package-retry) ("chore(ci): retry desktop packaging once after a transient failure"). Below that are #56072 (desktop-early-start), #56071 (desktop-release-files), #56070 (cli-target-jobs) and #55987 (release-runner-moves). Only the last commit belongs to this PR. It does not depend on the PRs below it: the commit also cherry-picks cleanly onto origin/dev (d889cb2).

Summary

Dev pushes stop paying for setup that only releases use. Releases keep all of it.

• version job: shallow checkout (drops fetch-depth: 0, which fetched about 560 MiB of history and tags); drops Install OpenCode and OPENCODE_API_KEY. All three served the changelog, removed in feat(release): isolate v2 stable publishing #48546.
• publish job: Login to GitHub Container Registry, Set up QEMU, Set up Docker Buildx, Cache apt packages (AUR) and Setup SSH for AUR now run only if: needs.version.outputs.release. Script.release (the same flag) gates everything that uses them: the Docker push, AUR, Homebrew and the commits using the identity Setup SSH for AUR sets.

Expected effect

Estimates from step timestamps of dev pushes 38814116264 and 38856436871. Nothing has run with this change yet.

• Both jobs are on the critical path, so this should be about 2 to 3 percent of a dev push.
• Releases also get the shallow checkout (10.8 s and 19 s full vs 3 to 5 s depth-1 in 38536124977 and 38785024495). Install OpenCode was already skipped on dev; on releases it took 2 s.
• Dev pushes lose the Failed to save: "/usr/bin/tar" warning. The AUR apt cache never saves or restores.

Evidence

• Step timings: version jobs 116694365421, 116832907980; publish jobs 116699353595, 116835502384.
• Nothing on a dev push uses the skipped setup. Dev publish logs show "release": false and no docker, ssh, AUR, Homebrew, commit or push output. A grep of every script script/publish.ts runs finds git, ssh and docker commands only behind Script.release. Without the SSH step, the git identity stays the app bot's.
• version works on a depth-1 checkout. git branch --show-current still works (beta run 38847224136, job 116800425738, resolves "channel": "beta" with --depth=1). A scratch depth-1 repo with the workflow's env gave the expected dev, beta and OPENCODE_BUMP=patch (2.0.31) outputs.
• Lint: actionlint, prettier --check and bun run lint:changed pass.

Things to know

• Beta merge conflicts. origin/dev merges into origin/beta (2fbdff9) cleanly today. This commit adds 5 conflict regions in publish.yml (7 to 12 on top of the stack), unavoidable because beta changed the same lines (chore(ci): speed up the beta desktop publish #55919):
  • version checkout: keep beta's if: env.BETA != 'true' and drop the with.
  • Five setup steps (4 regions): use if: needs.version.outputs.release && github.ref_name != 'beta'. Keep both comments above the login step, or merge them into one covering both conditions.
  • Both conditions are needed: beta's Beta version step always outputs release=true, so release alone would bring the setup back on every beta push.
  • The Install OpenCode and OPENCODE_API_KEY removal merges cleanly.
  • Beta pushes are unaffected. They use beta's own publish.yml. The beta condition is not added on dev, because a release dispatched from beta with dev's file publishes on latest and needs this setup.
• Possible follow-ups, not changed: version still creates an unused app token (about 1 s) and runs setup-bun (9 to 19 s); the AUR apt cache still costs about 0.5 s and a warning on releases.

Verification

publish.yml cannot run on a PR. On the first dev push after merge, check:

• version: checkout log shows fetch --no-tags ... --depth=1; no Install OpenCode step; the logged opencode script JSON shows "channel": "dev" and "version": "0.0.0-dev-<run number>"; downstream jobs get the same OPENCODE_VERSION.
• publish: the five setup steps show as skipped, @dev packages publish as before, and the Failed to save warning is gone.
• version and publish are each about 11 to 20 s shorter than in 38814116264 and 38856436871.

On the first release dispatch, check that the five steps run, version computes the bumped version, and the Docker push, AUR, Homebrew and release commits succeed as in 38785024495.

Rollback: revert this commit.