ci: call CD only for tag builds

.github/workflows/cd.yml

@@ -1,9 +1,10 @@
 name: CD
 
 on:
-  workflow_run:
-    workflows: [CI]
-    types: [completed]
+  workflow_call:
+    secrets:
+      K3S_KUBECONFIG:
+        required: true
 
 concurrency:
   group: cd-alisten
@@ -15,13 +16,9 @@ permissions:
 
 jobs:
   deploy:
-    if: >-
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      startsWith(github.event.workflow_run.head_branch, 'v')
     runs-on: ubuntu-latest
     env:
-      TAG: ${{ github.event.workflow_run.head_branch }}
+      TAG: ${{ github.ref_name }}
     steps:
       - uses: azure/setup-helm@v5
         with:
@@ -59,7 +56,7 @@ jobs:
         shell: bash
         env:
           KUBECONFIG: ${{ runner.temp }}/k3s-kubeconfig
-          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+          HEAD_SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
 

.github/workflows/ci.yml

@@ -162,3 +162,13 @@ jobs:
           repository="$(printf '%s' "${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')"
           printf '%s' "$GITHUB_TOKEN" | helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
           helm push "${RUNNER_TEMP}/helm-packages/alisten-${chart_version}.tgz" "oci://ghcr.io/${repository}/charts"
+
+  deploy:
+    needs: helm-release
+    if: github.ref_type == 'tag'
+    uses: ./.github/workflows/cd.yml
+    secrets:
+      K3S_KUBECONFIG: ${{ secrets.K3S_KUBECONFIG }}
+    permissions:
+      contents: read
+      packages: read