fix(ci): publish semver Docker tags on automated releases

[Majorfi]

Closes #76

Root cause

The reported cause (a bad tags: ["v*.*.*"] glob) is not the problem — that pattern is valid, and there is exactly one tag-triggered run in the repo's history (v0.3.0, 2025-09-12) which was a hand-pushed tag. As @ThibaultNocchi identified in their follow-up comment, the real cause is different.

release.yml pushes the release tag using the default GITHUB_TOKEN. GitHub deliberately suppresses workflow triggers for pushes made with that token to prevent recursive runs, so docker-publish.yml's tag trigger never fired for an automated release. Across the last 100 docker-publish.yml runs, every ref is a branch or a PR — the automated v0.2.x tags produced zero runs.

Fix

docker-publish.yml now accepts workflow_call with an optional version input, and release.yml invokes it directly after creating the tag. No new secrets or tokens are required.

metadata-action's procSemver resolves the version three ways, which lets a single value=${{ inputs.version }} cover every trigger path without duplicated enable= guards:

• blank value + non-tag ref → skipped
• blank value + tag ref → falls back to the ref
• non-blank value → overrides the ref

Invalid input only emits core.warning, so it can never fail a build.

Resulting tags

Trigger	Tags	Change
push to main	latest, main, 0.3.1, 0.3, sha-xxxxxxx	semver tags now published
pull request	none (build only, push: false)	unchanged
manual tag push	1.0.0, 1.0, sha-xxxxxxx	unchanged (ref fallback)
workflow_dispatch	ref-based	unchanged

Note on the removed main branch trigger

branches: ["main"] was dropped from docker-publish.yml. release.yml already runs on every push to main, so keeping both triggers would run two full multi-arch (amd64 + arm64) builds per push, racing to write the same latest, main and sha- tags.

The tradeoff: image publishing now depends on the create-tag job succeeding. Restoring that single line brings back an independent main build if you would rather keep it as a safety net.

Verification

• actionlint v1.7.12 — exit 0, clean (it validates the caller's with: against the callee's declared inputs)
• YAML parses for both workflows
• semver.valid('v0.3.1') → 0.3.1, rendering {{version}}=0.3.1 and {{major}}.{{minor}}=0.3; 'main' and '' → null (skipped)

Not verifiable before merge: an actual live run, since the workflow_call wiring only exercises once this is on main.

[Copilot]

🟡 Changes recommended

The reusable Docker workflow references inputs.version on non-workflow_call events, which can break push/pull_request runs unless the access is gated.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR fixes automated releases not publishing semantic-version Docker tags by switching Docker publishing from a tag-triggered workflow to a reusable workflow invoked directly from the release workflow.

Changes:

• Expose the newly created tag as an output from release.yml’s create-tag job and call the Docker publish workflow with that version.
• Add workflow_call support to docker-publish.yml and wire semver tag generation to an optional version input.
• Remove the push.branches: [main] trigger from docker-publish.yml to avoid duplicate publish runs on main.

File summaries

File	Description
.github/workflows/release.yml	Exposes the created tag as a job output and invokes the Docker publish workflow with that semver tag.
.github/workflows/docker-publish.yml	Adds workflow_call input for versioned publishing and updates metadata-action tag generation accordingly.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.