ci(release): gate image publish behind a manual approval (#482)

Attach the manifest job to a publish-images GitHub Environment so Docker Hub + GHCR tags only go live after a maintainer approves the release run. Build + Trivy scan still run automatically; approval is the last step. Adds RELEASE.md runbook.
2026-08-03 07:46:42 +02:00 · 2026-07-11 11:09:53 +08:00
parent d572b5c33c
commit b369b4fb41
2 changed files with 67 additions and 0 deletions
@@ -412,6 +412,12 @@ jobs:
    name: Create Multi-Arch Manifests
    needs: [release, docker, scan]
    runs-on: ubuntu-latest
+    # Manual publish gate: this job creates the public `latest` / version tags on
+    # Docker Hub + GHCR (the point at which images become pullable by tag). The
+    # `publish-images` environment requires a maintainer to approve the run in the
+    # Actions UI before it proceeds, so a release never auto-publishes to the
+    # registries. The image is already built and Trivy-scanned by this point.
+    environment: publish-images
    permissions:
      contents: read
      packages: write