ci(release): add workflow_dispatch with tag input (#954)

## Summary

- Adds a `workflow_dispatch` trigger to `release.yml` with a required
  `tag` input so maintainers can manually (re)build release artifacts
  for any tag when the `release: published` run failed to upload assets.
- Auto-detects whether to advance the `:latest`, `:<major>`, and
  `:<major>.<minor>` Docker tags: a pre-goreleaser step asks GitHub for
  the current Latest release and sets `MOVE_TAGS=true` iff the ref being
  built equals it. `.goreleaser.yaml` templates each moving tag against
  `.Env.MOVE_TAGS` and collapses to `{{ .Version }}` (which goreleaser
  dedupes) when false.

v2.5.0 and v2.6.0 currently have no artifacts -- both `release.yml`
runs failed because `useblacksmith/setup-docker-builder` dropped an
untracked `buildkitd.toml` into the repo root and goreleaser aborted on
the dirty state. With this trigger, we can rebuild those tags (or any
future misfire) without recutting the release and without corrupting
the floating Docker tags, no manual flag required.

Author: cpcloud

.github/workflows/release.yml

@@ -6,6 +6,12 @@ name: Release Artifacts
 on:
   release:
     types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to (re)build artifacts for (e.g. v2.6.0)"
+        required: true
+        type: string
 
 concurrency:
   group: release-artifacts
@@ -33,7 +39,7 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ github.event.release.tag_name || inputs.tag }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -53,12 +59,33 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Advance :latest / :<major> / :<major>.<minor> only when the ref we
+      # are building is the repository's current latest release. On a normal
+      # release:published run, the just-published tag is the latest by
+      # definition. On a workflow_dispatch backfill we ask GitHub which tag
+      # it considers "Latest" and compare -- this way a backfill of an older
+      # tag never drags the moving tags backward.
+      - name: Determine whether to advance moving Docker tags
+        id: move-tags
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUILD_REF: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          set -euo pipefail
+          latest=$(gh release view --repo "${{ github.repository }}" --json tagName --jq .tagName)
+          if [ "$BUILD_REF" = "$latest" ]; then
+            echo "value=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
         with:
           version: "v2.13.3"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MOVE_TAGS: ${{ steps.move-tags.outputs.value }}
 
       - name: Clean up untagged GHCR images
         env:

.goreleaser.yaml

@@ -42,9 +42,14 @@ dockers_v2:
       - "ghcr.io/micasa-dev/micasa"
     tags:
       - "{{ .Version }}"
-      - "{{ .Major }}.{{ .Minor }}"
-      - "{{ .Major }}"
-      - latest
+      # Moving tags only advance when the workflow resolves MOVE_TAGS=true,
+      # which happens iff the ref being built is the repository's current
+      # latest release. For rebuilds of older tags MOVE_TAGS=false, each
+      # line below collapses to {{ .Version }}, and goreleaser dedupes it
+      # against the first tag.
+      - '{{ if eq .Env.MOVE_TAGS "true" }}{{ .Major }}.{{ .Minor }}{{ else }}{{ .Version }}{{ end }}'
+      - '{{ if eq .Env.MOVE_TAGS "true" }}{{ .Major }}{{ else }}{{ .Version }}{{ end }}'
+      - '{{ if eq .Env.MOVE_TAGS "true" }}latest{{ else }}{{ .Version }}{{ end }}'
     platforms:
       - linux/amd64
       - linux/arm64