fix(ci): harden release automation workflows

.github/workflows/docker-release.yml

@@ -4,39 +4,57 @@ on:
   release:
     types:
       - published
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Stable tag to publish manually, for example v7.55.0
+        required: true
+        type: string
 
 concurrency:
-  group: docker-release-${{ github.ref }}
+  group: docker-release-${{ github.event_name == 'release' && github.event.release.tag_name || inputs.tag || github.ref }}
   cancel-in-progress: false
 
 jobs:
   publish:
-    if: ${{ !github.event.release.prerelease && startsWith(github.event.release.tag_name, 'v') && !contains(github.event.release.tag_name, '-') }}
+    if: ${{ github.event_name != 'release' || !github.event.release.prerelease }}
     runs-on: ubuntu-latest
 
     permissions:
       contents: read
       packages: write
 
-    env:
-      RELEASE_TAG: ${{ github.event.release.tag_name }}
-
     steps:
-      - name: Checkout release tag
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.release.tag_name }}
+      - name: Resolve target tag
+        id: target
+        env:
+          MANUAL_TAG: ${{ inputs.tag }}
+          RELEASE_EVENT_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
+            TARGET_TAG="${RELEASE_EVENT_TAG}"
+          else
+            TARGET_TAG="${MANUAL_TAG}"
+          fi
+
+          echo "tag=${TARGET_TAG}" >> "$GITHUB_OUTPUT"
 
       - name: Validate stable semver tag
         id: tag
         run: |
-          if [[ "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          if [[ "${{ steps.target.outputs.tag }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "publish=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
           echo "publish=false" >> "$GITHUB_OUTPUT"
-          echo "Skipping non-stable semver tag ${RELEASE_TAG}"
+          echo "Skipping non-stable semver tag ${{ steps.target.outputs.tag }}"
+
+      - name: Checkout release tag
+        if: steps.tag.outputs.publish == 'true'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.target.outputs.tag }}
 
       - name: Set up QEMU
         if: steps.tag.outputs.publish == 'true'
@@ -49,18 +67,34 @@ jobs:
       - name: Derive image metadata
         if: steps.tag.outputs.publish == 'true'
         id: meta
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          VERSION="${RELEASE_TAG#v}"
+          VERSION="${{ steps.target.outputs.tag }}"
+          VERSION="${VERSION#v}"
           MINOR="${VERSION%.*}"
           MAJOR="${VERSION%%.*}"
           OWNER_LOWER=$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')
           IMAGE="ghcr.io/${OWNER_LOWER}/ccs-dashboard"
+          REVISION=$(git rev-parse HEAD)
+          TAGS="${IMAGE}:${VERSION}
+          ${IMAGE}:${MINOR}
+          ${IMAGE}:${MAJOR}"
+
+          if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
+            TAGS="${TAGS}
+          ${IMAGE}:latest"
+          fi
 
           {
             echo "version=${VERSION}"
             echo "minor=${MINOR}"
             echo "major=${MAJOR}"
             echo "image=${IMAGE}"
+            echo "revision=${REVISION}"
+            echo "tags<<EOF"
+            echo "${TAGS}"
+            echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
       - name: Log in to GitHub Container Registry
@@ -79,17 +113,13 @@ jobs:
           file: docker/Dockerfile
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: |
-            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}
-            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.minor }}
-            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.major }}
-            ${{ steps.meta.outputs.image }}:latest
+          tags: ${{ steps.meta.outputs.tags }}
           labels: |
             org.opencontainers.image.title=ccs-dashboard
             org.opencontainers.image.description=CCS Dashboard container image
             org.opencontainers.image.url=https://github.com/${{ github.repository }}
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
             org.opencontainers.image.version=${{ steps.meta.outputs.version }}
-            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
           cache-from: type=gha
           cache-to: type=gha,mode=max