fix(docker): harden release image publishing

.github/workflows/docker-release.yml

@@ -3,7 +3,7 @@ name: Publish Docker Image
 on:
   push:
     tags:
-      - 'v*'
+      - 'v*.*.*'
 
 concurrency:
   group: docker-release-${{ github.ref }}
@@ -22,13 +22,27 @@ jobs:
       - name: Checkout release tag
         uses: actions/checkout@v4
 
+      - name: Validate stable semver tag
+        id: tag
+        run: |
+          if [[ "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "publish=false" >> "$GITHUB_OUTPUT"
+          echo "Skipping non-stable semver tag ${GITHUB_REF_NAME}"
+
       - name: Set up QEMU
+        if: steps.tag.outputs.publish == 'true'
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
+        if: steps.tag.outputs.publish == 'true'
         uses: docker/setup-buildx-action@v3
 
       - name: Derive image metadata
+        if: steps.tag.outputs.publish == 'true'
         id: meta
         run: |
           VERSION="${GITHUB_REF_NAME#v}"
@@ -45,6 +59,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Log in to GitHub Container Registry
+        if: steps.tag.outputs.publish == 'true'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -52,6 +67,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push release image
+        if: steps.tag.outputs.publish == 'true'
         uses: docker/build-push-action@v6
         with:
           context: .