ci: migrate image publish from ECR to GHCR (single-branch release)

.github/workflows/release.yml

@@ -1,8 +1,9 @@
 name: Release
 
 on:
-  release:
-    types: [created]
+  push:
+    tags:
+      - 'v*'
 
 env:
   REGISTRY: ghcr.io
@@ -17,6 +18,17 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify tag is on main
+        run: |
+          git fetch origin main
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
+            echo "Tag ${GITHUB_REF} ($GITHUB_SHA) is not reachable from main."
+            echo "Single-branch release policy: only tags on main may be released."
+            exit 1
+          fi
 
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
@@ -32,9 +44,9 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=ref,event=branch
-            type=ref,event=pr
             type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
 
       - uses: docker/build-push-action@v6
         with:
@@ -47,47 +59,21 @@ jobs:
             VERSION=${{ steps.meta.outputs.version }}
 
       - name: extract amd64 binary from the image
-        run: | 
-          docker create --platform linux/amd64 --name amd64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} && 
+        run: |
+          docker create --platform linux/amd64 --name amd64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
           docker cp amd64:/usr/bin/coroot-node-agent /tmp/coroot-node-agent-amd64
 
       - name: extract arm64 binary from the image
         run: |
-          docker create --platform linux/arm64 --name arm64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} &&
+          docker create --platform linux/arm64 --name arm64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
           docker cp arm64:/usr/bin/coroot-node-agent /tmp/coroot-node-agent-arm64
 
-      - name: upload amd64 binary
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Create GitHub release with binaries
+        uses: softprops/action-gh-release@v2
         with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: /tmp/coroot-node-agent-amd64
-          asset_name: coroot-node-agent-amd64
-          asset_content_type: application/octet-stream
-
-      - name: upload arm64 binary
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: /tmp/coroot-node-agent-arm64
-          asset_name: coroot-node-agent-arm64
-          asset_content_type: application/octet-stream
-
-      - uses: actions/github-script@v7
-        env:
-            RELEASE_ID: ${{ github.event.release.id }}
-        with:
-          script: |
-            const { RELEASE_ID } = process.env
-            github.rest.repos.updateRelease({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              release_id: `${RELEASE_ID}`,
-              prerelease: false,
-              make_latest: true
-            })  
-
-
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          make_latest: true
+          files: |
+            /tmp/coroot-node-agent-amd64
+            /tmp/coroot-node-agent-arm64