Fix the release workflow's cache scope and branch selection (#37)

Two fixes to the release workflow #36 added. No new functionality —
`Dockerfile` and the multi-arch build itself are untouched.

## The multi-platform cache scope was invalid

```yaml
cache-from: type=gha,scope=release-${{ inputs.platforms }}
```

expanded to `type=gha,scope=release-linux/amd64,linux/arm64`. A
`type=gha` value is itself a comma-separated key=value list, so the
comma inside the platform list terminated `scope` and buildx read the
leftover `linux/arm64` as a bare key:

```
ERROR: invalid value linux/arm64
```

That killed the run before any build step, so **any dispatch with the
default multi-platform list failed**. Only a single-platform run (no
comma) got through.

Both cache flags now use one shared `release` scope. The
per-platform-set keying it replaces wasn't worth having: GHA cache
scopes are separate namespaces, so sharing one lets a single-platform
run reuse layers a multi-arch run already cached instead of starting
cold.

## The `branch` input silently overrode the branch you picked

There were two branch selectors, and the one you didn't touch won. **Use
workflow from** chose which `release.yml` ran; the `branch` input chose
what got checked out and tagged — and it defaulted to `master`.
Dispatching from a feature branch and leaving the input alone therefore
ran that branch's workflow against master's tree and pushed
`master-<sha>`, `master`, `latest`.

The input is gone. `actions/checkout` now takes no `ref:` at all, so it
uses the dispatch commit, and the tag slug comes from `github.ref_name`.
One branch picker, and no way for the built ref to disagree with it.

Remaining inputs: `image`, `extra_tag`, `latest`, `platforms`.

## README

Updated to match: **Use workflow from** is the only branch to choose,
and the `/`-to-`-` tag slugification is now stated.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01TzoV12kHAHm6EFNmUfZedq

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Pijukatel

.github/workflows/release.yml

@@ -1,15 +1,14 @@
 name: Release Docker image
 
-# Manual-only: pick a branch (or any ref - tag/SHA works too) and this builds the runtime image for
-# every platform in `platforms` and pushes it to Docker Hub as one multi-arch manifest per tag, so a
-# single tag serves x86_64 Linux/Windows-WSL2/Intel Mac and arm64 (Apple Silicon, Ampere) alike.
+# Manual-only: builds the runtime image for every platform in `platforms` and pushes it to Docker Hub
+# as one multi-arch manifest per tag, so a single tag serves x86_64 Linux/Windows-WSL2/Intel Mac and
+# arm64 (Apple Silicon, Ampere) alike.
+#
+# It always builds the branch it was dispatched from ("Use workflow from") - there is no ref input, so
+# there is no second branch to keep in sync with the one you picked.
 on:
     workflow_dispatch:
         inputs:
-            branch:
-                description: Branch (or tag/SHA) to build the image from
-                required: true
-                default: master
             image:
                 description: Docker Hub repository to push to
                 required: true
@@ -34,9 +33,9 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 60
         steps:
+            # No `ref:` - checkout defaults to the commit the workflow was dispatched from, which is
+            # exactly the branch picked in "Use workflow from".
             - uses: actions/checkout@v4
-              with:
-                  ref: ${{ inputs.branch }}
 
             # Fail here rather than three slow build steps later, with the fix named.
             - name: Check Docker Hub credentials are configured
@@ -57,7 +56,7 @@ jobs:
               id: tags
               env:
                   IMAGE: ${{ inputs.image }}
-                  BRANCH: ${{ inputs.branch }}
+                  BRANCH: ${{ github.ref_name }}
                   EXTRA_TAG: ${{ inputs.extra_tag }}
                   LATEST: ${{ inputs.latest }}
               run: |
@@ -104,15 +103,18 @@ jobs:
                   tags: ${{ steps.tags.outputs.tags }}
                   provenance: mode=max
                   sbom: true
-                  # Keyed per platform set so a run for one platform list doesn't evict another's cache.
-                  cache-from: type=gha,scope=release-${{ inputs.platforms }}
-                  cache-to: type=gha,mode=max,scope=release-${{ inputs.platforms }}
+                  # One shared scope: a `type=gha` value is itself a comma-separated key=value list,
+                  # so interpolating the (comma-separated) platform list into `scope` would end the
+                  # value early and buildx would reject the leftover as a key. Sharing the scope also
+                  # lets a single-platform run reuse the layers a multi-arch run already cached.
+                  cache-from: type=gha,scope=release
+                  cache-to: type=gha,mode=max,scope=release
                   labels: |
                       org.opencontainers.image.title=actor-runtime
                       org.opencontainers.image.description=A minimal, self-contained local Apify platform in a single Docker image.
                       org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
                       org.opencontainers.image.revision=${{ steps.tags.outputs.revision }}
-                      org.opencontainers.image.version=${{ inputs.branch }}
+                      org.opencontainers.image.version=${{ github.ref_name }}
 
             - name: Summary
               env:

README.md

@@ -121,14 +121,16 @@ Images currently go to the temporary dev repository
 will move to an Apify-owned namespace later).
 
 The **Release Docker image** workflow (`.github/workflows/release.yml`) is manual only: Actions ->
-Release Docker image -> Run workflow, then pick the branch to build (plus, optionally, an extra tag
-such as `v0.1.0`, whether to also move `:latest`, and which platforms to build). It pushes one
-multi-arch manifest per tag - `linux/amd64` and `linux/arm64` by default - so the same tag serves
-x86_64 and Apple Silicon.
-
-Every run publishes `<branch>-<short-sha>` (immutable) and `<branch>` (moving). It needs two
-repository secrets: `DOCKERHUB_USERNAME` and `DOCKERHUB_TOKEN` (a Docker Hub access token with
-Read/Write from <https://hub.docker.com/settings/security>).
+Release Docker image -> Run workflow, pick the branch in **Use workflow from**, and run it. That is
+the only branch to choose - the workflow always builds the branch it was dispatched from. Everything
+else is optional: an extra tag such as `v0.1.0`, whether to also move `:latest`, and which platforms
+to build.
+
+It pushes one multi-arch manifest per tag - `linux/amd64` and `linux/arm64` by default - so the same
+tag serves x86_64 and Apple Silicon. Every run publishes `<branch>-<short-sha>` (immutable) and
+`<branch>` (moving), with `/` in a branch name slugified to `-`. It needs two repository secrets:
+`DOCKERHUB_USERNAME` and `DOCKERHUB_TOKEN` (a Docker Hub access token with Read/Write from
+<https://hub.docker.com/settings/security>).
 
 ## Development