Add functional dry_run input to workflow_dispatch

Gates GitHub release and marketplace publish behind the input
rather than implicitly relying on tag presence. Tag pushes still
publish (inputs.dry_run is falsy when undefined).

Author: j-256

.github/workflows/ci.yml

@@ -7,6 +7,11 @@ on:
   pull_request:
     branches: [main]
   workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Dry run (skip GitHub release and marketplace publish)
+        type: boolean
+        default: true
 
 jobs:
   test:
@@ -163,15 +168,15 @@ jobs:
           echo "All VSIX contents verified"
 
       - name: Create or update GitHub release
-        if: startsWith(github.ref, 'refs/tags/v')
+        if: startsWith(github.ref, 'refs/tags/v') && !inputs.dry_run
         run: |
           gh release create "$GITHUB_REF_NAME" git-crypt-vscode-*.vsix --title "$GITHUB_REF_NAME" --generate-notes ||
           gh release upload "$GITHUB_REF_NAME" git-crypt-vscode-*.vsix --clobber
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish to marketplace
-        if: startsWith(github.ref, 'refs/tags/v')
+        if: ${{ !inputs.dry_run }}
         run: npm run publish -- --packagePath git-crypt-vscode-*.vsix
         env:
           VSCE_PAT: ${{ secrets.VSCE_PAT }}