try this

Author: bleggett

.github/workflows/build.yml

@@ -54,62 +54,10 @@ jobs:
         echo "matrix=$(cat matrix.json)" >> "${GITHUB_OUTPUT}"
     outputs:
       matrix: "${{ steps.capture-matrix.outputs.matrix }}"
-  build-only:
-    name: "build ${{ matrix.builds.version }} ${{ matrix.builds.flavor }}"
-    needs: matrix
-    # lower perms, since this is not a job that needs to publish
-    permissions:
-      contents: read
-      packages: read
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJSON(needs.matrix.outputs.matrix) }}
-    runs-on: "${{ matrix.builds.runner }}"
-    env:
-      KERNEL_PUBLISH: "${{ inputs.publish }}"
-      KERNEL_VERSION: "${{ matrix.builds.version }}"
-      KERNEL_SRC_URL: "${{ matrix.builds.source }}"
-      FIRMWARE_URL: "${{ matrix.builds.firmware_url }}"
-      FIRMWARE_SIG_URL: "${{ matrix.builds.firmware_sig_url }}"
-      KERNEL_FLAVOR: "${{ matrix.builds.flavor }}"
-      KERNEL_TAGS: "${{ join(matrix.builds.tags, ',') }}"
-      KERNEL_ARCHITECTURES: "${{ join(matrix.builds.architectures, ',') }}"
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
-        with:
-          egress-policy: audit
-
-      - name: checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          submodules: recursive
-      - name: install cosign
-        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
-      - name: docker setup linux-kernel-oci
-        run: sudo python3 ./hack/build/docker-setup.py
-      - name: docker setup buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
-      - name: docker login ghcr.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        with:
-          registry: ghcr.io
-          username: "${{github.actor}}"
-          password: "${{secrets.GITHUB_TOKEN}}"
-      - name: generate docker script
-        run: "./hack/build/generate-docker-script.sh"
-      - name: upload docker script
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: "build-${{ matrix.builds.version }}-${{ matrix.builds.flavor }}.sh"
-          path: "docker.sh"
-          compression-level: 0
-      - name: run docker script
-        run: sh -x docker.sh
   build-publish:
     # this job will publish images, and needs higher perms.
     # It may not be invoked by another workflow, only invoked directly
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    if: github.event_name =! 'workflow_call'
     name: "build ${{ matrix.builds.version }} ${{ matrix.builds.flavor }}"
     needs: matrix
     # Higher perms, since this is publish

.github/workflows/test.yml

@@ -4,9 +4,9 @@ on:
   push:
     branches:
     - main
-permissions:
-  contents: read
-  packages: read
+# permissions:
+#   contents: read
+#   packages: read
 # env:
 #   TEST_MATRIX_SPEC: "only-latest:flavor=host,zone,zone-nvidiagpu"
 jobs: