Make full Docker image build opt-in via manual workflow trigger; update CI workflow and README.

Author: CoderYellow

.github/workflows/build.yml

@@ -1,13 +1,19 @@
 name: build
 
-# Builds the project inside the Docker image (downloading all Maven dependencies and
-# producing the module jars), then publishes the image to GitHub Container Registry.
+# Publishes images to GitHub Container Registry. By default only the slim image
+# (org.openprojectx.* Maven artifacts) is built. The full image (full Maven build with all
+# deps + jars) is opt-in: trigger the workflow manually with "build_full" enabled.
 on:
   push:
     branches: [ main, master ]
     tags: [ 'v*' ]
   pull_request:
   workflow_dispatch:
+    inputs:
+      build_full:
+        description: 'Also build and push the full (heavy) image'
+        type: boolean
+        default: false
 
 env:
   REGISTRY: ghcr.io
@@ -40,8 +46,10 @@ jobs:
         id: vars
         run: echo "short_sha=${GITHUB_SHA:0:8}" >> "$GITHUB_OUTPUT"
 
+      # Full image: opt-in only (manual run with build_full=true). Disabled by default.
       - name: Docker metadata
         id: meta
+        if: ${{ inputs.build_full }}
         uses: docker/metadata-action@v5
         with:
           # metadata-action lowercases the image name, so mixed-case owners are fine.
@@ -56,6 +64,7 @@ jobs:
       # The Dockerfile runs `mvn install` (install the deps and build in the image build),
       # keeping the downloaded deps, built jars and source inside the published image.
       - name: Build and push image
+        if: ${{ inputs.build_full }}
         uses: docker/build-push-action@v6
         with:
           context: .

README.md

@@ -146,12 +146,13 @@ docker build -f Dockerfile.slim -t spark-test-openprojectx .
 
 ## CI / GitHub Container Registry
 
-[`.github/workflows/build.yml`](.github/workflows/build.yml) builds that image (installing the deps
-and building the jars in the image build) and publishes it to **GitHub Container Registry**
-(`ghcr.io/<owner>/spark-test`) on pushes to the default branch and on `v*` tags. It also builds and
-pushes the [slim image](#slim-image-dockerfileslim) to the same repo with `-slim`-suffixed tags
-(`latest-slim`, `<short-sha>-slim`, …). It needs no extra secrets — it authenticates with the
-built-in `GITHUB_TOKEN` (`packages: write`). Pull requests build both images but do not push.
+[`.github/workflows/build.yml`](.github/workflows/build.yml) publishes to **GitHub Container
+Registry** (`ghcr.io/<owner>/spark-test`). By **default it builds and pushes only the
+[slim image](#slim-image-dockerfileslim)** (`-slim`-suffixed tags: `latest-slim`, `<short-sha>-slim`,
+…). The full image (the heavy full Maven build) is **opt-in and disabled by default** — trigger the
+workflow manually (`workflow_dispatch`) with the **`build_full`** input enabled to also build and
+push it. It needs no extra secrets — it authenticates with the built-in `GITHUB_TOKEN`
+(`packages: write`). Pull requests build the image(s) but do not push.
 
 [`.github/workflows/windows.yml`](.github/workflows/windows.yml) runs on `windows-latest` to check
 Windows compatibility: it builds every module with Maven and verifies the `hadoop-native-loader`