fix(ci): scope publishing to version tag pushes - #909

Open

AndreaDiazCorreia wants to merge 12 commits into

mainfrom

fix/ci-harden-release-workflows

Commits on Aug 20, 2026

fix: harden GitHub Actions shell scripts with set -euo pipefail and env vars
AndreaDiazCorreia
committed
08730ef
fix: prevent manual workflow runs from overwriting release Docker image tags
AndreaDiazCorreia
committed
6bc1fca
fix: narrow GitHub Actions permissions for StartOS Docker build workflow
AndreaDiazCorreia
committed
f29e045
fix: prevent manual workflow runs from publishing to crates.io or creating GitHub releases
AndreaDiazCorreia
committed
b0a5f2c
fix: serialize StartOS Docker image pushes with a concurrency group
AndreaDiazCorreia
committed
8e0e7c4
fix: prevent workflow_dispatch from publishing when targeting a tag ref
AndreaDiazCorreia
committed
24f0ee4
fix: scope Docker build concurrency group to ref instead of global queue
AndreaDiazCorreia
committed
1184f53
fix: tighten stable release detection to exact vX.Y.Z tags
AndreaDiazCorreia
committed
5599bac
fix: fail Docker build workflow early when tag push is not an exact vX.Y.Z release
AndreaDiazCorreia
committed
77a8a68
fix: assign `latest` Docker tag only to the highest semver release
AndreaDiazCorreia
committed
fa0692b
refactor: move `latest` Docker tag promotion to a separate job after both images finish building
AndreaDiazCorreia
committed
1face8a

Commits on Aug 23, 2026

refactor: deduplicate Docker build jobs into a matrix and move tag resolution to a separate job
AndreaDiazCorreia
committed
b86541c