From b52dfcbf0fff7a93fa1d9305722ea25665dfe08a Mon Sep 17 00:00:00 2001
From: Gabe M <hey@gabe.mx>
Date: Sat, 31 Oct 2026 14:39:06 -0600
Subject: [PATCH] ci: add manual publishing from main

---
 .github/workflows/publish.yml | 45 +++++++++++++++++++++++++++++++++++
 README.md                     | 12 ++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..8933130
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,45 @@
+name: Publish
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: opencode-publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish v1 and v2 from main
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Set up Task
+        uses: arduino/setup-task@v2
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Publish both tracks
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: task publish
diff --git a/README.md b/README.md
index f0bc4b8..948486b 100644
--- a/README.md
+++ b/README.md
@@ -144,6 +144,18 @@ task docker:push:v1                        # Push v1 as +<version> and +v1
 retains existing GitHub releases, and creates missing releases tagged at the
 checked-out commit. Only v2 releases are marked GitHub's **Latest** release.
 
+### Manual GitHub Actions publishing
+
+Run **Actions → Publish → Run workflow** to publish both pinned versions from
+`main`. Add these repository Actions secrets first:
+
+- `DOCKERHUB_USERNAME`: Docker Hub account with push access to `sprisa/opencode`.
+- `DOCKERHUB_TOKEN`: Docker Hub access token with Read & Write permissions.
+
+The workflow checks out `main` with full tag history, sets up multi-architecture
+builds, logs in to Docker Hub, and runs `task publish`. GitHub releases use the
+automatically provided `GITHUB_TOKEN` with `contents: write` permission.
+
 ## Updating the opencode version
 
 ```bash