Enable writing to ghcr from pull requests

.github/workflows/pr-build-container-image.yml

@@ -0,0 +1,37 @@
+name: PRs » Build container image
+
+on:
+  push:
+    branches-ignore:
+      - 'dependabot/**'
+  pull_request:
+    types:
+      - opened
+      - synchronize
+
+jobs:
+  container-image-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push images
+        uses: docker/build-push-action@v6
+        with:
+          push: false # This is handled in another workflow!
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=docker,dest=${{ runner.temp }}/build.tar
+
+      - name: Upload docker image to GHA
+        uses: actions/upload-artifact@v4
+        with:
+          name: build
+          path: ${{ runner.temp }}/build.tar

.github/workflows/pr-deploy-container-image.yml

@@ -1,27 +1,19 @@
-name: PRs » Publish container image
+name: PRs » Push container image
 
 on:
-  push:
-    branches-ignore:
-      - 'dependabot/**'
-  pull_request:
+  workflow_run:
+    workflows: ["PRs » Build container image"]
     types:
-      - opened
-      - synchronize
+      - completed
 
 jobs:
-  container-image:
+  container-image-deploy:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
-
-      - name: Prepare commit hash
-        run: git rev-parse HEAD > commit
-
       - name: Log in to the container registry
         uses: docker/login-action@v3
         with:
@@ -35,13 +27,17 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository }}
 
-      - name: Build and push images
-        uses: docker/build-push-action@v6
+      - name: Download docker image from GHA
+        uses: actions/download-artifact@v4
         with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          name: build
+          path: ${{ runner.temp }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Load image
+        run: |
+          docker load --input ${{ runner.temp }}/build.tar
+          docker push ghcr.io/${{ github.repository }}
 
       - name: Add comment
         if: github.event_name == 'pull_request'