Add workflow_dispatch for dry-run builds

Allows manually triggering the full build + package + verify pipeline
from the Actions tab without publishing to marketplace or creating a
GitHub release. Tag-only steps are gated with step-level conditionals.

Author: j-256

.github/workflows/ci.yml

@@ -6,6 +6,7 @@ on:
     tags: [v*]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 jobs:
   test:
@@ -21,7 +22,7 @@ jobs:
       - run: npm test
 
   build-git-crypt:
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
     strategy:
       matrix:
         include:
@@ -94,7 +95,7 @@ jobs:
 
   publish:
     needs: [test, build-git-crypt]
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -103,6 +104,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Verify tag is on main
+        if: startsWith(github.ref, 'refs/tags/v')
         run: |
           if ! git branch -r --contains "$GITHUB_SHA" | grep -q 'origin/main'; then
             echo "Error: tag $GITHUB_REF_NAME is not on the main branch"
@@ -113,6 +115,7 @@ jobs:
           node-version: 22
       - run: npm ci
       - name: Verify tag matches package.json version
+        if: startsWith(github.ref, 'refs/tags/v')
         run: |
           PKG_VERSION="v$(node -p 'require("./package.json").version')"
           if [ "$PKG_VERSION" != "$GITHUB_REF_NAME" ]; then
@@ -149,13 +152,15 @@ jobs:
           npx vsce ls --packagePath "$UNIVERSAL" | grep -c 'bin/git-crypt' | xargs -I{} test {} -eq 0
 
       - name: Create or update GitHub release
+        if: startsWith(github.ref, 'refs/tags/v')
         run: |
           gh release create "$GITHUB_REF_NAME" git-crypt-vscode-*.vsix --title "$GITHUB_REF_NAME" --generate-notes ||
           gh release upload "$GITHUB_REF_NAME" git-crypt-vscode-*.vsix --clobber
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish to marketplace
+        if: startsWith(github.ref, 'refs/tags/v')
         run: npx vsce publish --packagePath git-crypt-vscode-*.vsix
         env:
           VSCE_PAT: ${{ secrets.VSCE_PAT }}