ci(build): update dependency order and remove unused build artifact s…

.github/workflows/build.yml

@@ -100,6 +100,10 @@ jobs:
       # Pin libcares to a known-good tag. SPC 2.8.4 release-metadata lookup has been
       # flaky for c-ares/c-ares; pinning + direct URL bypasses the GH releases API path.
       LIBCARES_VERSION: '1.34.6'
+      # GitHub-hosted macOS runners currently include untrusted third-party
+      # Homebrew taps unrelated to this build. Keep the transition behavior
+      # explicit until Homebrew trust checks become the default.
+      HOMEBREW_NO_REQUIRE_TAP_TRUST: '1'
 
     steps:
       - name: Checkout
@@ -273,7 +277,7 @@ jobs:
 
   docker:
     name: Docker image
-    needs: build
+    needs: test
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -283,20 +287,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - name: Download linux binaries from build job
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          path: ./artifacts
-          pattern: clonio-linux-*
-          merge-multiple: true
-
-      - name: Stage binaries for Docker context
-        run: |
-          mkdir -p bin
-          cp artifacts/clonio-linux-x86_64  bin/clonio-linux-amd64
-          cp artifacts/clonio-linux-aarch64 bin/clonio-linux-arm64
-          chmod +x bin/clonio-linux-*
-
       - name: Set up QEMU
         uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
 
@@ -312,6 +302,18 @@ jobs:
           tags: clonio:smoke-test
           cache-from: type=gha
 
+      - name: Smoke test — PHP database extensions (Docker)
+        run: |
+          docker run --rm --entrypoint php clonio:smoke-test -r '
+          $required = ["pdo_sqlite", "sqlite3", "sqlsrv", "pdo_sqlsrv"];
+          $missing = array_values(array_filter($required, static fn ($extension) => ! extension_loaded($extension)));
+          if ($missing !== []) {
+              fwrite(STDERR, "Missing PHP extensions: ".implode(", ", $missing).PHP_EOL);
+              exit(1);
+          }
+          echo "Required PHP database extensions are loaded.".PHP_EOL;
+          '
+
       - name: Smoke test — functional (Docker)
         run: ./tests/smoke/run-smoke.sh docker clonio:smoke-test
 
@@ -425,9 +427,7 @@ jobs:
 
           cat >> release-notes.md <<'EOF'
 
-          ## Changelog
-
-          ${{ steps.changelog.outputs.changelog }}
+          See the full [CHANGELOG.md](https://github.com/clonio-dev/clonio-cli/blob/main/CHANGELOG.md).
 
           ---
 

.github/workflows/update-changelog.yml

@@ -0,0 +1,45 @@
+name: "Update Changelog"
+
+on:
+  release:
+    types: [released]
+
+permissions:
+  contents: write
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          ref: main
+
+      - name: Prepare release notes for changelog
+        id: notes
+        env:
+          RELEASE_BODY: ${{ github.event.release.body }}
+        run: |
+          NOTES=$(printf '%s' "$RELEASE_BODY" \
+            | awk '/^## Changelog$/ { exit } /^---$/ { exit } /^## Installation$/ { exit } { print }')
+          {
+            echo "body<<CHANGELOG_NOTES_EOF"
+            printf '%s\n' "$NOTES"
+            echo "CHANGELOG_NOTES_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Update Changelog
+        uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1
+        with:
+          latest-version: ${{ github.event.release.name }}
+          release-notes: ${{ steps.notes.outputs.body }}
+
+      - name: Commit updated CHANGELOG
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
+        with:
+          branch: main
+          commit_message: Update CHANGELOG
+          file_pattern: CHANGELOG.md