Estrella Pan 122cf68eac fix(ci): release only from manually pushed tags, never from merged PRs ...

Merging PR #1063 ("Doc update", 3.3-dev -> main) triggered the stable
release path, which fell back to the raw PR title as the version string
and shipped a Docker image tagged Doc-update as :latest — every
container pulling latest then crashed on SemVer parsing (#1065).

The release trigger is now explicit:
- bare X.Y.Z tag -> stable release, refused unless the tagged commit is
  an ancestor of main
- tag containing alpha/beta -> pre-release (unchanged)
- PR merges only run tests and a docker build test

Also pass head.ref through an env var instead of inlining it in the
script (injection hardening), and take release notes solely from the
changelog file since tag pushes carry no PR body.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jejs2dffkscAbhZkcjZ1oK

2026-07-08 16:25:09 +02:00

..

build.yml

fix(ci): release only from manually pushed tags, never from merged PRs

2026-07-08 16:25:09 +02:00